(** Coq coding by choukh, Sep 2021 **)

Require Export ZFC.LargeOrdinals.SidedTetration.
Require Import ZFC.LargeOrdinals.GeneralEpsilon.
Import OrdinalClass 𝐎𝐍Operation.

Local Hint Resolve
  add_ran mul_ran exp_ran ordAdd_ran ordMul_ran
  preOrdExp_ran ordExp_ran ordTetL_ran ordTet0_ran
  ε_operative bunion_of_ords_is_ord : core.

(** 迭代幂次 **)
(** Tetration **)
(* adapted from https://math.stackexchange.com/a/3768438/815418 *)
Definition OrdTet := λ α, Operation 1 (λ ξ, α ^ ξ ∪ ξ ^ α).
Notation "α ^^ β" := (OrdTet α β) (at level 25) : OrdArith_scope.

Theorem ordTet_0_r : ∀α ⋵ 𝐎𝐍, α ^^ 0 = 1.
Proof. intros α H. apply operation_0; auto. Qed.

Theorem ordTet_suc : ∀ α β ⋵ 𝐎𝐍, α ^^ β⁺ = α ^ (α ^^ β) ∪ (α ^^ β) ^ α.
Proof. intros α Hα β Hβ. apply operation_suc; auto. Qed.

Theorem ordTet_limit : ∀α ⋵ 𝐎𝐍, continuous (OrdTet α).
Proof. intros α Hα. apply operation_limit; auto. Qed.

Theorem ordTet_ran : ∀ α β ⋵ 𝐎𝐍, α ^^ β ⋵ 𝐎𝐍.
Proof with nauto.
  intros α Hα β Hβ. apply operation_operative...
Qed.
Local Hint Resolve ordTet_ran : core.

Theorem ordTet_0_l : ∀α ⋵ 𝐎𝐍, 0 ^^ α = 1.
Proof with neauto.
  ord_induction. intros α Hα IH.
  ord_destruct α.
  - subst. apply ordTet_0_r...
  - destruct Hsuc as [γ [Hγ H]]. subst.
    rewrite ordTet_suc, IH, ordExp_0_l, ordExp_0_r, ord_max_r...
  - rewrite ordTet_limit... ext.
    + apply FUnionE in H as [β [Hβ H]]. rewrite IH in H...
    + apply EmptyNE in H0 as [β Hβ]. eapply FUnionI... rewrite IH...
Qed.

Theorem ordTet_1_r : ∀α ⋵ 𝐎𝐍, α ≠ 0 → α ^^ 1 = α.
Proof with nauto.
  intros α H H0. rewrite pred, ordTet_suc...
  rewrite ordTet_0_r, ordExp_1_r, ordExp_1_l, ord_max_l...
  apply ord_suc_correct...
Qed.

Theorem ordTet_1_l : ∀α ⋵ 𝐎𝐍, 1 ^^ α = 1.
Proof with neauto.
  ord_induction. intros α Hα IH.
  ord_destruct α.
  - subst. apply ordTet_0_r...
  - destruct Hsuc as [γ [Hγ H]]. subst.
    rewrite ordTet_suc, IH, ordExp_1_r, ord_max_r...
  - rewrite ordTet_limit... ext.
    + apply FUnionE in H as [β [Hβ H]]. rewrite IH in H...
    + apply EmptyNE in H0 as [β Hβ]. eapply FUnionI... rewrite IH...
Qed.

Theorem ordTet_2_r : ∀α ⋵ 𝐎𝐍, α ≠ 0 → α ^^ 2 = α ^ α.
Proof.
  intros α Hα Hα0.
  rewrite pred, ordTet_suc, ordTet_1_r, ord_max_r; nauto.
Qed.

Theorem ordTet_eq_L : ∀α ⋵ 𝐎𝐍, α ≠ 0 → ∀n ∈ ω, α ^^ n⁺ = α ^^ᴸ n.
Proof with nauto.
  intros α Hα Hα0 n Hn.
  destruct (classic (α = 1)) as [|Hα1]. {
    subst. rewrite ordTet_1_l, ordTetL_1_l...
  }
  destruct (classic (α = 2)) as [|Hα2]. {
    subst. ω_induction n.
    - rewrite ordTet_1_r, ordTetL_0...
    - destruct (classic (m = 0)) as [|Hm0]. {
        subst. rewrite ordTet_suc, IH...
        rewrite ordTetL_suc, ordTetL_0, ord_max_l...
      }
      rewrite ordTet_suc, IH, ordTetL_suc, ord_max_l...
      apply ordTetL_exp_r_le_l...
  }
  ω_induction n.
  - rewrite ordTet_1_r, ordTetL_0...
  - destruct (classic (m = 0)) as [|Hm0]. {
      subst. rewrite ordTet_suc, IH...
      rewrite ordTetL_suc, ordTetL_0, ord_max_l...
    }
    rewrite ordTet_suc, IH, ordTetL_suc, ord_max_l...
    left. apply ordTetL_exp_r_lt_l... contra.
    apply ord_le_iff_not_gt in H as []...
    rewrite two in H. apply TwoE in H as []... rewrite <- one in H...
Qed.

Theorem ordTet_suc_l : ∀α ⋵ 𝐎𝐍, α ≠ 0 → ∀n ∈ ω, α ^^ n⁺ = α ^ (α ^^ n).
Proof with auto.
  intros α Hα Hα0 n Hn.
  destruct (classic (α = 1)) as [|Hα1]. {
    subst. rewrite ordTet_1_l, ordTet_1_l, ordExp_1_r...
  }
  ω_induction n.
  - rewrite ordTet_1_r, ordTet_0_r, ordExp_1_r...
  - rewrite ordTet_eq_L, ordTet_eq_L, ordTetL_suc...
    apply ω_inductive...
Qed.

Theorem ordTet_ω_eq_ε_0 : ∀α ⋵ 𝐎𝐍, 1 ∈ α → α ^^ ω = ε α 0.
Proof with neauto.
  intros α Hα Hα1.
  apply ord_gt_1_neq_0_1 in Hα1 as [Hα0 Hα1]...
  rewrite ordTet_limit... ext.
  - apply FUnionE in H as [n [Hn Hx]].
    ω_destruct n.
    + rewrite ordTet_0_r, one in Hx...
      apply SingE in Hx. subst. apply ε_has_n...
    + rewrite ε_0... rewrite ordTet_eq_L in Hx... eapply FUnionI...
  - rewrite ε_0 in H... apply FUnionE in H as [n [Hn Hx]].
    rewrite <- ordTet_eq_L in Hx...
    apply (FUnionI _ _ n⁺)... apply ω_inductive...
Qed.

Lemma ordTet_neq_0 : ∀ α β ⋵ 𝐎𝐍, α ^^ β ≠ 0.
Proof with eauto.
  intros α Hα. ord_induction. intros β Hβ IH H.
  ord_destruct β.
  - subst. rewrite ordTet_0_r in H...
  - destruct Hsuc as [γ [Hγ Heq]]. subst.
    rewrite ordTet_suc in H...
    apply union_eq_empty in H as [].
    + apply EmptyNI in H... exists (α ^ α ^^ γ)... apply PairI1.
    + symmetry in H. apply single_eq_pair in H as [H Heq].
      symmetry in H. apply ordExp_eq_0 in H...
      subst. rewrite ordExp_0_l, ordExp_0_r in Heq...
  - rewrite ordTet_limit in H...
    apply union_eq_empty in H as [].
    + apply repl_eq_empty in H. exfalso...
    + apply EmptyNE in H0 as [γ Hγ].
      assert (Hoγ: γ ⋵ 𝐎𝐍). eapply ord_is_ords...
      apply sucord_in_limord in Hγ...
      eapply repl_eq_1 in Hγ as H0... eapply IH...
Qed.
Local Hint Resolve ordTet_neq_0 : core.

Lemma ordTet_gt_1 : ∀ α β ⋵ 𝐎𝐍, 1 ∈ α → β ≠ 0 → 1 ∈ α ^^ β.
Proof with neauto.
  intros α Hα. ord_induction. intros β Hβ IH Hα1 Hβ0.
  ord_destruct β.
  - subst...
  - destruct Hsuc as [γ [Hγ Heq]]. subst.
    destruct (classic (γ = 0)) as [|Hγ0]. {
      subst. rewrite ordTet_1_r... apply ord_gt_1_neq_0_1...
    }
    rewrite ordTet_suc... eapply ord_trans... auto.
    apply BUnionI1. apply ordExp_enlarge_r...
  - rewrite ordTet_limit...
    apply EmptyNE in H0 as [γ Hγ].
    assert (Hoγ: γ ⋵ 𝐎𝐍). eapply ord_is_ords...
    eapply FUnionI. apply sucord_in_limord...
    destruct (classic (γ = 0)) as [|Hγ0]. {
      subst. rewrite ordTet_1_r... apply ord_gt_1_neq_0_1...
    }
    eapply ord_trans_lt_le. auto. apply IH...
    rewrite ordTet_suc... left. apply BUnionI2. apply ordExp_enlarge_r...
Qed.
Local Hint Resolve ordTet_gt_1 : core.

Theorem ordTet_eq_1 : ∀ α β ⋵ 𝐎𝐍, α ^^ β = 1 → α = 0 ∨ α = 1 ∨ β = 0.
Proof with neauto.
  intros α Hα β Hβ H.
  destruct (classic (α = 0))...
  destruct (classic (α = 1))...
  destruct (classic (β = 0))... exfalso.
  apply (ord_irrefl 1)... rewrite <- H at 2.
  apply ordTet_gt_1...
Qed.

Theorem ordTet_normal : ∀α ⋵ 𝐎𝐍, 1 ∈ α → normal (OrdTet α).
Proof with nauto.
  intros α Hα Hα1. apply operation_normal...
  fold (OrdTet α). intros x Hx.
  destruct (classic (x = 0)) as [|Hx0]. {
    subst. rewrite ordTet_0_r, ordTet_1_r... apply ord_gt_1_neq_0_1...
  }
  rewrite ordTet_suc... apply BUnionI2.
  apply ordExp_enlarge_r...
Qed.

Fact ordTet_is_limord_r : ∀α ⋵ 𝐎𝐍, ∀𝜆 ⋵ 𝐎𝐍ˡⁱᵐ, 1 ∈ α → 𝜆 ≠ 0 → α ^^ 𝜆 ⋵ 𝐎𝐍ˡⁱᵐ.
Proof with neauto.
  intros α Hα 𝜆 H𝜆 H1 H2.
  apply normal_operation_limit_is_limit...
  apply ordTet_normal...
Qed.

Fact ordTet_is_limord_l : ∀α ⋵ 𝐎𝐍, ∀𝜆 ⋵ 𝐎𝐍ˡⁱᵐ, α ≠ 0 → 𝜆 ≠ 0 → 𝜆 ^^ α ⋵ 𝐎𝐍ˡⁱᵐ.
Proof with neauto.
  ord_induction. intros α Hα IH 𝜆 H𝜆 Hα0 H𝜆0.
  ord_destruct α.
  - subst...
  - destruct Hsuc as [β [Hβ Heq]]. subst.
    destruct (classic (β = 0)) as [|Hβ0]. {
      subst. rewrite ordTet_1_r...
    }
    assert (H1: 1 ∈ 𝜆 ^^ β). {
      apply ord_neq_0_1_gt_1...
      intros H. apply ordTet_eq_1 in H as [|[]]...
      apply (limord_iff_not_sucord 𝜆)... exists 0...
    }
    rewrite ordTet_suc...
    epose proof (ord_comparability (𝜆 ^ 𝜆 ^^ β) _ (𝜆 ^^ β ^ 𝜆)) as []...
    + rewrite ord_max_r... apply ordExp_is_limord_r...
    + rewrite ord_max_l... apply ordExp_is_limord_l...
  - rewrite ordTet_limit...
    replace (sup {𝜆 ^^ α0 | α0 ∊ α}) with (sup {𝜆 ^^ α0 | α0 ∊ α - {0,}}).
    + apply union_of_limords_is_limord. intros x Hx.
      apply ReplAx in Hx as [β [Hβ Hx]]. subst x.
      apply SepE in Hβ as [Hβ Hβ']. apply SingNE in Hβ'. apply IH...
    + ext.
      * apply FUnionE in H as [β [Hβ Hx]].
        apply SepE1 in Hβ. eapply FUnionI...
      * apply FUnionE in H as [β [Hβ Hx]].
        assert (Hoβ: β ⋵ 𝐎𝐍). apply (ord_is_ords α)...
        apply (FUnionI _ _ β⁺). apply SepI.
        apply sucord_in_limord... apply SingNI. apply suc_neq_0.
        eapply ord_trans... apply ordTet_normal...
        eapply ord_trans_lt_le. auto. apply embed_ran. apply limord_ge_ω...
  Unshelve. auto.
Qed.

Corollary ordTet_preserve_lt : ∀ α β γ ⋵ 𝐎𝐍, 1 ∈ α →
  β ∈ γ ↔ α ^^ β ∈ α ^^ γ.
Proof with eauto.
  intros α Hα β Hβ γ Hγ Hα1. split; intros H.
  apply ordTet_normal...
  destruct (classic (β = γ)).
  - subst. exfalso. eapply ord_irrefl; revgoals...
  - apply ord_connected in H0 as []...
    apply (proj1 (ordTet_normal α Hα Hα1)) in H0...
    exfalso. eapply ord_not_lt_gt; revgoals...
Qed.

Corollary ordTet_cancel : ∀ α β γ ⋵ 𝐎𝐍, 1 ∈ α → α ^^ β = α ^^ γ → β = γ.
Proof with eauto.
  intros α Hα β Hβ γ Hγ H1 Heq.
  contra. apply ord_connected in H as [Hlt|Hlt]...
  - assert (α ^^ β ∈ α ^^ γ). apply ordTet_normal...
    rewrite Heq in H. eapply ord_irrefl; revgoals...
  - assert (α ^^ γ ∈ α ^^ β). apply ordTet_normal...
    rewrite Heq in H. eapply ord_irrefl; revgoals...
Qed.

Theorem ordTet_preserve_le_l : ∀ α β γ ⋵ 𝐎𝐍,
  α ⋸ β → α ^^ γ ⋸ β ^^ γ.
Proof with eauto.
  intros α Hα β Hβ γ Hγ Hle.
  generalize dependent γ.
  ord_induction; intros γ Hγ IH.
  ord_destruct γ.
  - subst. rewrite ordTet_0_r, ordTet_0_r...
  - destruct Hsuc as [δ [Hδ Heq]]. subst.
    destruct Hle; [|subst; right]...
    destruct (classic (β = 0)) as [|Hβ0]. {
      subst. exfalso0.
    }
    destruct (classic (β = 1)) as [|Hβ1]. {
      subst. rewrite one in H. apply SingE in H. subst.
      rewrite ordTet_0_l, ordTet_1_l...
    }
    destruct (classic (α = 0)) as [|Hα0]. {
      subst. rewrite ordTet_0_l...
    }
    destruct (classic (α = 1)) as [|Hα1]. {
      subst. rewrite ordTet_1_l...
    }
    destruct (classic (δ = 0)) as [|Hδ0]. {
      subst. rewrite ordTet_1_r, ordTet_1_r...
    }
    apply ord_le_iff_sub... rewrite ordTet_suc, ordTet_suc...
    intros x Hx. apply BUnionE in Hx as [Hx|Hx].
    + apply BUnionI1. eapply ord_trans_lt_le... clear Hx.
      eapply ord_trans_le. auto.
      apply ordExp_preserve_le_r. 5: apply IH. 1-5: auto.
      apply ordExp_preserve_le_l...
    + apply BUnionI2. eapply ord_trans_lt_le... clear Hx.
      eapply ord_trans_le. auto.
      apply ordExp_preserve_le_l. 4: apply IH. 1-4: auto.
      apply ordExp_preserve_le_r...
  - apply ord_le_iff_sub...
    rewrite ordTet_limit, ordTet_limit...
    intros x Hx. apply FUnionE in Hx as [δ [Hδ Hx]].
    assert (Hoδ: δ ⋵ 𝐎𝐍). eapply ord_is_ords...
    eapply FUnionI... apply IH in Hδ as []...
    eapply ord_trans... congruence.
Qed.

Fact ordTet_preserve_le_r : ∀ α β γ ⋵ 𝐎𝐍, 1 ∈ γ →
  α ⋸ β → γ ^^ α ⋸ γ ^^ β.
Proof.
  intros α Hα β Hβ γ Hγ H0 [].
  left. apply ordTet_preserve_lt; auto.
  right. congruence.
Qed.

Lemma ordTet_enlarge_r : ∀ α β ⋵ 𝐎𝐍, 1 ∈ α → 1 ∈ β → α ∈ α ^^ β.
Proof with nauto.
  intros α Hα β Hβ Hα1 Hβ1. rewrite <- ordTet_1_r at 1...
  apply ordTet_preserve_lt... apply ord_gt_1_neq_0_1...
Qed.

Lemma ordTet_enlarge_l : ∀ α β ⋵ 𝐎𝐍, 1 ∈ β → α ⋸ β ^^ α.
Proof with auto.
  intros α Hα β Hβ Hβ1.
  apply monotone_operation_weakly_increasing...
  apply ordTet_normal...
Qed.

Lemma ordTet_enlarge_lt : ∀ α β γ ⋵ 𝐎𝐍, γ ≠ 0 → α ∈ β → α ∈ β ^^ γ.
Proof with neauto.
  intros α Hα β Hβ γ Hγ H0 Hle.
  destruct (classic (β = 0)). subst. exfalso0.
  destruct (classic (β = 1)). {
    subst. rewrite one in Hle. apply SingE in Hle.
    subst. apply ord_neq_0_gt_0...
  }
  destruct (classic (γ = 1)). subst. rewrite ordTet_1_r...
  rewrite <- (ordTet_1_r β) in Hle...
  eapply (ord_trans (β ^^ γ))...
  apply ordTet_preserve_lt...
Qed.

Lemma ordTet_enlarge_le : ∀ α β γ ⋵ 𝐎𝐍, γ ≠ 0 → α ⋸ β → α ⋸ β ^^ γ.
Proof with neauto.
  intros α Hα β Hβ γ Hγ H0 Hle.
  destruct (classic (β = 0)). {
    subst. rewrite ordTet_0_l...
    destruct Hle. exfalso0. subst...
  }
  destruct (classic (β = 1)). subst. rewrite ordTet_1_l...
  rewrite <- (ordTet_1_r β) in Hle...
  eapply ord_trans_le. auto. apply Hle.
  apply ordTet_preserve_le_r...
  apply ord_le_iff_not_gt... intros Hγ1.
  rewrite one in Hγ1. apply SingE in Hγ1...
Qed.

Section Epsilon.
Local Notation ε := (ε ω).
Local Hint Resolve ε_has_n ε_neq_0 : core.

Theorem ω_tet_ω : ω ^^ ω = ε 0.
Proof. apply ordTet_ω_eq_ε_0; nauto. Qed.

Lemma ε_exp_ω : ∀α ⋵ 𝐎𝐍, (ε α) ^ ω = (ω ^^⁰ 2) (ε α)⁺.
Proof with nauto.
  intros α Hα.
  rewrite (pred 2), ordTet0_suc...
  rewrite (pred 1), ordTet0_suc...
  rewrite ordTet0_0, <- ordAdd_1_r, <- ordExp_add, ordExp_1_r...
  rewrite epsilon, <- ordExp_mul, epsilon...
Qed.

Fact ωtω_1 : ω ^^ (ω + 1) = (ω ^^⁰ 2) (ε 0)⁺.
Proof with nauto.
  rewrite (pred 1), ordAdd_suc, ordTet_suc, ordAdd_0_r...
  rewrite ordTet_ω_eq_ε_0, <- ε_exp_ω, ord_max_r...
  rewrite epsilon... left. apply ordExp_enlarge_r...
Qed.

Fact ωtω_2 : ω ^^ (ω + 2) = (ω ^^⁰ 3) (ε 0)⁺.
Proof with nauto.
  rewrite (pred 2), ordAdd_suc, ordTet_suc, ord_max_l...
  - rewrite (pred 3), ordTet0_suc, ωtω_1...
  - rewrite ωtω_1, <- ε_exp_ω... left.
    rewrite <- (epsilon) at 1...
    rewrite ordExp_mul, ordExp_mul...
    apply ordExp_preserve_lt...
    apply (ord_trans_le_lt _ (ε 0 ⋅ ε 0))...
    apply ordMul_preserve_le_r... rewrite <- epsilon_mul...
    apply ordMul_preserve_le_r... apply ε_ge_ω...
    rewrite <- (ordExp_2_r)... apply ordExp_preserve_lt...
Qed.

Lemma ωtω_n_gt_ω : ∀n ∈ ω, n ≠ 0 → ω ∈ ω ^^ (ω + n).
Proof with nauto.
  intros n Hn Hn0. apply ordTet_enlarge_r...
  eapply ord_trans. auto. apply embed_ran. apply ordAdd_enlarge_r...
Qed.

Lemma ωtω_exp_ω_r_lt_l : ∀n ∈ ω, n ≠ 0 → ω ^^ (ω + n) ^ ω ⋸ ω ^ ω ^^ (ω + n).
Proof with nauto.
  intros n Hn. ω_induction n; intros Hn0. exfalso...
  destruct (classic (m = 0)) as [|Hm0].
  - subst. rewrite suc, add_0_l, ωtω_1...
    rewrite (pred 2), ordTet0_suc, ordTet0_1...
    assert (Hε: ε 0 ⋵ 𝐎𝐍)... left.
    rewrite ordExp_mul... apply ordExp_preserve_lt...
    rewrite <- (ordExp_1_r ω) at 3...
    rewrite ordExp_add... apply ordExp_preserve_lt...
    rewrite ordExp_suc, epsilon...
    rewrite <- ordAdd_1_r, ordAdd_assoc, ordAdd_1_1...
    eapply (ord_trans _ _ _ (ε 0 + ε 0)).
    apply ordAdd_preserve_lt... rewrite <- ordMul_2_r...
    apply ordMul_preserve_lt...
  - rewrite ordAdd_suc, ordTet_suc, ord_max_l...
    rewrite ordExp_mul... apply ordExp_preserve_le_r...
    eapply ord_trans_le; revgoals... left.
    eapply (ord_trans _ _ _ (ω ^^ (ω + m) ⋅ ω ^^ (ω + m))).
    apply ordMul_preserve_lt... apply ωtω_n_gt_ω...
    rewrite <- ordExp_2_r... apply ordExp_preserve_lt...
    eapply ord_trans. auto. apply embed_ran. apply ωtω_n_gt_ω...
  Unshelve. 1-2: auto.
Qed.

Theorem ωtω_n : ∀n ∈ ω, n ≠ 0 → ω ^^ (ω + n) = (ω ^^⁰ n⁺) (ε 0)⁺.
Proof with nauto.
  intros n Hn. ω_induction n; intros Hn0. exfalso...
  destruct (classic (m = 0)) as [|Hm0]. subst. apply ωtω_1.
  rewrite ordAdd_suc, ordTet0_suc, <- IH...
  rewrite ordTet_suc, ord_max_l, IH...
  apply ωtω_exp_ω_r_lt_l...
Qed.

Lemma ε_tet0_n : ∀α ⋵ 𝐎𝐍, ∀n ∈ ω, n ≠ 0 → (ε α ^^⁰ n) ω = (ω ^^⁰ n⁺) (ε α)⁺.
Proof with nauto.
  intros α Hα n Hn. ω_induction n; intros H0. exfalso...
  destruct (classic (m = 0)) as [Hm0|Hm0].
  - subst. rewrite ordTet0_1, ε_exp_ω...
  - rewrite ordTet0_suc, ordTet0_suc, IH, ordTet0_suc...
    rewrite <- epsilon at 1...
    rewrite ordExp_mul... 2: apply ordExp_ran... f_equal.
    rewrite <- epsilon at 1... rewrite ordExp_add... f_equal.
    ω_destruct m. exfalso...
    rewrite <- epsilon at 1... rewrite ordTet0_suc...
    apply ordAdd_ω_pow_absorption...
    clear Hn n Hm0 H0 IH Hm. rename m into n.
    ω_induction n.
    + rewrite ordTet0_0...
    + rewrite ordTet0_suc... eapply ord_trans_lt_le; revgoals.
      apply ordExp_enlarge_l... apply IH. apply ordExp_ran...
Qed.

Theorem ωtω_ω : ω ^^ (ω + ω) = ε 1.
Proof with neauto.
  rewrite pred, ε_suc...
  erewrite <- (ordTet0_eq_ordTetL_ω (ε 0) _ ω)... 2: {
    rewrite ε_0... apply (FUnionI _ _ 1)...
    rewrite ordTetL_1_r... apply ordExp_enlarge_r...
  }
  rewrite ordTet_limit, ordTet0_limit...
  2: apply ordAdd_is_limord...
  2: intros H; apply ordAdd_eq_0 in H as []...
  ext.
  - apply FUnionE in H as [α [Hα H]].
    assert (Hoα: α ⋵ 𝐎𝐍). apply (ord_is_ords (ω + ω))...
    rewrite ordAdd_limit in Hα...
    apply FUnionE in Hα as [n [Hn Hα]].
    ω_destruct n.
    + apply (FUnionI _ _ 1)... rewrite ordTet0_1...
      eapply ord_trans... rewrite <- ω_tet_ω.
      eapply ord_trans. auto. apply ordTet_preserve_lt; revgoals...
      rewrite ordAdd_0_r... apply ordExp_enlarge_r...
    + apply (FUnionI _ _ n⁺)... rewrite ε_tet0_n, <- ωtω_n...
      eapply ord_trans... apply ordTet_preserve_lt...
  - apply FUnionE in H as [n [Hn H]].
    ω_destruct n.
    + rewrite ordTet0_0 in H...
      apply (FUnionI _ _ 1)... 2: rewrite ordTet_1_r...
      eapply ord_trans. auto. apply embed_ran.
      apply ordAdd_enlarge_r...
    + rewrite ε_tet0_n, <- ωtω_n in H...
      eapply FUnionI... apply ordAdd_preserve_lt...
  Unshelve. apply ε_operative...
Qed.

Definition ε_k := λ k, ε k = ω ^^ (ω ⋅ k⁺).

Lemma ωtωk_1 : ∀k ∈ ω, ε_k k → ω ^^ (ω ⋅ k⁺ + 1) = (ω ^^⁰ 2) (ε k)⁺.
Proof with nauto.
  intros k Hk IH.
  rewrite (pred 1), ordAdd_suc, ordTet_suc, ordAdd_0_r...
  repeat rewrite <- IH. rewrite <- ε_exp_ω, ord_max_r...
  rewrite epsilon... left. apply ordExp_enlarge_r...
Qed.

Lemma ωtωk_exp_ω_r_lt_l : ∀ k n ∈ ω, ε_k k → n ≠ 0 → ω ^^ (ω ⋅ k⁺ + n) ^ ω ⋸ ω ^ ω ^^ (ω ⋅ k⁺ + n).
Proof with nauto.
  intros k Hk n Hn IHk. ω_induction n; intros Hn0. exfalso...
  destruct (classic (m = 0)) as [|Hm0].
  - subst. rewrite ωtωk_1, <- ordTet0_suc...
    repeat rewrite pred... repeat rewrite ordTet0_suc...
    rewrite ordTet0_0... left. rewrite ordExp_mul...
    assert (Hran: ω ^ (ε k)⁺ ⋵ 𝐎𝐍). apply ordExp_ran...
    apply ordExp_preserve_lt...
    rewrite <- (ordExp_1_r ω) at 3... rewrite ordExp_add...
    apply ordExp_preserve_lt...
    rewrite <- ordAdd_1_r, ordAdd_assoc, ordAdd_1_1...
    eapply (ord_trans _ _ _ (ε k + ε k)).
    apply ordAdd_preserve_lt... rewrite <- ordMul_2_r...
    rewrite <- ordExp_add, epsilon, ordExp_1_r...
    apply ordMul_preserve_lt...
  - assert (Hran: ω ^^ (ω ⋅ k⁺ + m) ⋵ 𝐎𝐍). apply ordTet_ran...
    assert (Hsum0: ω ⋅ k⁺ + m ≠ 0). {
      intros H. apply ordAdd_eq_0 in H as []...
    }
    assert (Hsum1: ω ⋅ k⁺ + m ≠ 1). {
      intros H. apply ordAdd_eq_1 in H as [[H _]|[]]...
      apply ordMul_eq_0 in H as []... apply (suc_neq_0 k)...
    }
    assert (Htet1: 1 ∈ ω ^^ (ω ⋅ k⁺ + m)). apply ordTet_gt_1...
    rewrite ordAdd_suc, ordTet_suc, ord_max_l...
    rewrite ordExp_mul... apply ordExp_preserve_le_r...
    eapply ord_trans_le; revgoals... left.
    eapply (ord_trans _ _ _ (ω ^^ (ω ⋅ k⁺ + m) ⋅ ω ^^ (ω ⋅ k⁺ + m))).
    apply ordMul_preserve_lt... apply ord_gt_1_neq_0_1...
    apply ordTet_enlarge_r... apply ord_neq_0_1_gt_1...
    rewrite <- ordExp_2_r... apply ordExp_preserve_lt...
  Unshelve. apply ordExp_ran... auto.
Qed.

Lemma ωtωk_n : ∀ k n ∈ ω, ε_k k → n ≠ 0 → ω ^^ (ω ⋅ k⁺ + n) = (ω ^^⁰ n⁺) (ε k)⁺.
Proof with nauto.
  intros k Hk n Hn IHk. ω_induction n; intros Hn0. exfalso...
  destruct (classic (m = 0)) as [|Hm0].
  - subst. apply ωtωk_1...
  - rewrite ordAdd_suc, ordTet0_suc, <- IH...
    rewrite ordTet_suc, ord_max_l, IH...
    apply ordExp_ran... apply ordTet_ran...
    apply ordExp_ran... apply ordTet_ran...
    apply ωtωk_exp_ω_r_lt_l...
Qed.

Theorem ε_n : ∀n ∈ ω, ε n = ω ^^ (ω ⋅ n⁺).
Proof with neauto.
  intros n Hn. ω_induction n.
  - subst. rewrite ordMul_1_r, ω_tet_ω...
  - assert (H0: ω ⋅ m⁺ ≠ 0). {
      intros H. apply ordMul_eq_0 in H as []... eapply suc_neq_0...
    }
    rewrite ε_suc, ordMul_suc...
    erewrite <- (ordTet0_eq_ordTetL_ω (ε m) _ ω)... 2: {
      rewrite IH. apply ordTet_enlarge_r...
      apply ord_neq_0_1_gt_1... intros H.
      apply ordMul_eq_1 in H as []...
      apply (nat_irrefl 1)... rewrite <- H at 2...
    }
    rewrite ordTet0_limit, ordTet_limit...
    2: apply ordAdd_is_limord...
    2: intros H; apply ordAdd_eq_0 in H as []...
    ext.
    + apply FUnionE in H as [k [Hk H]].
      ω_destruct k.
      * rewrite ordTet0_0 in H...
        apply (FUnionI _ _ 1)... 2: rewrite ordTet_1_r...
        eapply ord_trans_lt_le. auto. apply embed_ran.
        apply ordAdd_enlarge_l...
      * rewrite ε_tet0_n, <- ωtωk_n in H...
        eapply FUnionI... apply ordAdd_preserve_lt...
    + apply FUnionE in H as [α [Hα Hx]].
      assert (Hoα: α ⋵ 𝐎𝐍). apply (ord_is_ords (ω ⋅ m⁺ + ω))...
      rewrite ordAdd_limit in Hα...
      apply FUnionE in Hα as [k [Hk Hα]].
      ω_destruct k.
      * apply (FUnionI _ _ 1)... rewrite ordTet0_1...
        eapply ord_trans... eapply ord_trans. nauto.
        apply ordTet_preserve_lt; revgoals...
        rewrite ordAdd_0_r, IH... apply ordExp_enlarge_r...
      * apply (FUnionI _ _ k⁺)... rewrite ε_tet0_n, <- ωtωk_n...
        eapply ord_trans... apply ordTet_ran... apply ordAdd_ran...
        apply ordTet_preserve_lt... apply ordAdd_ran...
  Unshelve. apply ε_operative...
Qed.

Corollary ε_ω : ε ω = ω ^^ (ω ^ 2).
Proof with neauto.
  rewrite ε_limit, ordExp_2_r, ordTet_limit...
  2: apply ordMul_is_limord_l...
  2: intros H; apply ordMul_eq_0 in H as []...
  ext.
  - apply FUnionE in H as [n [Hn H]]. rewrite ε_n in H...
    apply (FUnionI _ _ (ω ⋅ n⁺))... apply ordMul_preserve_lt...
    apply ω_inductive...
  - apply FUnionE in H as [α [Hα H]].
    assert (Hoα: α ⋵ 𝐎𝐍). apply (ord_is_ords (ω ⋅ ω))...
    rewrite ordMul_limit in Hα...
    apply FUnionE in Hα as [n [Hn Hα]].
    apply (FUnionI _ _ n)... rewrite ε_n...
    eapply ord_trans... apply ordTet_preserve_lt...
    eapply ord_trans... apply ordMul_preserve_lt...
Qed.

End Epsilon.


Require Export Fiat.Common.Coq__8_4__8_5__Compat.
Require Import Coq.Arith.EqNat Coq.Arith.Compare_dec Coq.ZArith.ZArith.
Require Import Coq.Lists.List.
Require Import Fiat.Common.List.ListFacts.
Require Import Fiat.Common.
Set Implicit Arguments.

Local Arguments leb !_ !_.

Section fixedpoints.
  Context {A : Type}
          (sizeof : A -> nat)
          (step : A -> A)
          (step_monotonic : forall a, sizeof (step a) <= sizeof a)
          (step_eq : forall a, sizeof (step a) = sizeof a -> step a = a)
          (upperbound : A).

  Definition greatest_fixpoint_step
             (greatest_fixpoint : nat -> A -> A)
             (sz : nat)
             (a : A)
    : A
    := match sz with
       | 0 => a
       | S sz'
         => let a' := step a in
            let sza := sizeof a in
            let sza' := sizeof a' in
            if leb (S sza') sza
            then greatest_fixpoint sz' a'
            else a
       end.

  Fixpoint greatest_fixpoint' (sz : nat)
    : A -> A
    := greatest_fixpoint_step greatest_fixpoint' sz.

  Definition greatest_fixpoint (a : A) := greatest_fixpoint' (sizeof a) a.

  Lemma greatest_fixpoint_fixpoint a : step (greatest_fixpoint a) = greatest_fixpoint a.
  Proof.
    unfold greatest_fixpoint.
    set (sz := sizeof a).
    assert (H : sizeof a <= sz) by reflexivity.
    clearbody sz.
    revert dependent a.
    induction sz as [|sz IHsz].
    { simpl.
      intros a Hle.
      assert (sizeof (step a) <= 0) by (etransitivity; [ apply step_monotonic | apply Hle ]).
      apply step_eq; lia. }
    { simpl.
      intros.
      repeat match goal with
             | [ |- context[if ?e then _ else _] ] => destruct e eqn:?
             | [ H : leb _ _ = true |- _ ]
               => apply leb_iff in H
             | [ H : leb _ _ = false |- _ ]
               => apply leb_iff_conv in H
             | _ => solve [ eauto with nocore ]
             | [ |- step _ = _ ] => apply step_eq
             | _ => lia
             | [ H : forall a, _ -> _ = _ |- _ ] => rewrite H by lia
             | [ H : _ < _ |- _ ] => hnf in H
             | [ H : S _ <= S _ |- _ ] => apply Le.le_S_n in H
             | [ H : sizeof ?x <= ?y, H' : ?y <= sizeof (step ?x) |- _ ]
               => let H'' := fresh in
                  assert (H'' : sizeof (step x) <= sizeof x) by apply step_monotonic;
                    assert (sizeof x = y) by lia;
                    assert (y = sizeof (step x)) by lia;
                    clear H H' H''
             | [ H : sizeof ?x <= sizeof (step ?x) |- _ ]
               => let H'' := fresh in
                  assert (H'' : sizeof (step x) <= sizeof x) by apply step_monotonic;
                    assert (sizeof x = sizeof (step x)) by lia;
                    clear H H''
             end. }
  Qed.
End fixedpoints.

Section listpair.
  Context {A B : Type}
          (fA : list A -> list B -> A -> bool)
          (fB : list A -> list B -> B -> bool)
          (upperA : list A)
          (upperB : list B).

  Definition sizeof_pair (lss : list A * list B) : nat
    := length (fst lss) + length (snd lss).

  Let step (lss : list A * list B) : list A * list B
    := (filter (fA (fst lss) (snd lss)) (fst lss),
        filter (fB (fst lss) (snd lss)) (snd lss)).

  Lemma step_monotonic lss : sizeof_pair (step lss) <= sizeof_pair lss.
  Proof.
    unfold step, sizeof_pair; simpl;
      apply Plus.plus_le_compat;
      apply length_filter.
  Qed.

  Lemma step_eq lss
    : sizeof_pair (step lss) = sizeof_pair lss -> step lss = lss.
  Proof.
    unfold sizeof_pair, step; simpl.
    destruct lss as [lsA lsB]; simpl.
    intro H.
    repeat match goal with
           | [ H : context[filter ?f ?ls] |- _ ]
             => unique pose proof (length_filter f ls)
           end.
    match goal with
    | [ H : ?x + ?y = ?x' + ?y' |- _ = _ :> list _ * list _ ]
      => assert (x = x') by lia;
           assert (y = y') by lia;
           clear H
    end.
    rewrite !length_filter_eq by lia.
    reflexivity.
  Qed.

  Definition greatest_fixpoint_of_lists : list A * list B
    := greatest_fixpoint sizeof_pair step (upperA, upperB).

  Definition greatest_fixpoint_of_lists_fixpoint
    : step greatest_fixpoint_of_lists = greatest_fixpoint_of_lists.
  Proof.
    apply greatest_fixpoint_fixpoint.
    { intros; apply step_monotonic. }
    { intros; apply step_eq; assumption. }
  Qed.

  Lemma greatest_fixpoint_of_lists_correct_1
        (lsA := fst greatest_fixpoint_of_lists)
        (lsB := snd greatest_fixpoint_of_lists)
    : fold_right andb true (map (fA lsA lsB) lsA) = true.
  Proof.
    unfold lsA at 2.
    rewrite <- greatest_fixpoint_of_lists_fixpoint.
    unfold step; simpl.
    apply fold_right_andb_true_map_filter.
  Qed.

  Lemma greatest_fixpoint_of_lists_correct_2
        (lsA := fst greatest_fixpoint_of_lists)
        (lsB := snd greatest_fixpoint_of_lists)
    : fold_right andb true (map (fB lsA lsB) lsB) = true.
  Proof.
    unfold lsB at 2.
    rewrite <- greatest_fixpoint_of_lists_fixpoint.
    unfold step; simpl.
    apply fold_right_andb_true_map_filter.
  Qed.
End listpair.


(** * Prop: Propositions and Evidence *)

(* $Date: 2012-07-23 16:26:25 -0400 (Mon, 23 Jul 2012) $ *)

Require Export Poly.

(** In previous chapters, we have seen many examples of factual
    claims (_propositions_) and ways of presenting evidence of their
    truth (_proofs_).  In particular, we have worked extensively with
    _equality propositions_ of the form [e1 = e2], with
    implications ([P -> Q]), and with quantified propositions
    ([forall x, P]).

    In this chapter we take a deeper look at the way propositions are
    expressed in Coq and at the structure of the logical evidence that
    we construct when we carry out proofs.

    Some of the concepts in this chapter may seem a bit abstract on a
    first encounter.  We've included a _lot_ of exercises, most of
    which should be quite approachable even if you're still working on
    understanding the details of the text.  Try to work as many of
    them as you can, especially the one-starred exercises. *)

(* ##################################################### *)
(** * Inductively Defined Propositions *)

(** As a running example for the first part of the chapter, let's
    consider a simple property of natural numbers, and let's say that
    the numbers possessing this property are "beautiful." *)

(** Informally, a number is _beautiful_ if it is [0], [3], [5], or the
    sum of two beautiful numbers.  More pedantically, we can define
    beautiful numbers by giving four rules:

       - Rule [b_0]: The number [0] is beautiful.
       - Rule [b_3]: The number [3] is beautiful.
       - Rule [b_5]: The number [5] is beautiful.
       - Rule [b_sum]: If [n] and [m] are both beautiful, then so is
         their sum. *)

(** We will see many definitions like this one during the rest of the
    course, and for purposes of informal discussions, it is helpful to
    have a lightweight notation that makes them easy to read and
    write.  _Inference rules_ are one such notation: *)
(**
                              -----------                               (b_0)
                              beautiful 0

                              ------------                              (b_3)
                              beautiful 3

                              ------------                              (b_5)
                              beautiful 5

                       beautiful n     beautiful m
                       ---------------------------                      (b_sum)
                              beautiful (n+m)
*)

(** Each of the textual rules above is reformatted here as an
    inference rule; the intended reading is that, if the _premises_
    above the line all hold, then the _conclusion_ below the line
    follows.  For example, the rule [b_sum] says that, if [n] and [m]
    are both beautiful numbers, then it follows that [n+m] is
    beautiful too.  The rules with no premises above the line are
    called _axioms_.

    These rules _define_ the property [beautiful].  That is, if we
    want to convince someone that some particular number is beautiful,
    our argument must be based on these rules.  For a simple example,
    suppose we claim that the number [5] is beautiful.  To support
    this claim, we just need to point out that rule [b_5] says it is.
    Or, if we want to claim that [8] is beautiful, we can support our
    claim by first observing that [3] and [5] are both beautiful (by
    rules [b_3] and [b_5]) and then pointing out that their sum, [8],
    is therefore beautiful by rule [b_sum].  This argument can be
    expressed graphically with the following _proof tree_:
         ----------- (b_3)   ----------- (b_5)
         beautiful 3         beautiful 5
         ------------------------------- (b_sum)
                   beautiful 8
    Of course, there are other ways of using these rules to argue that
    [8] is beautiful -- for instance:
         ----------- (b_5)   ----------- (b_3)
         beautiful 5         beautiful 3
         ------------------------------- (b_sum)
                   beautiful 8
*)

(** **** Exercise: 1 star (varieties_of_beauty) *)
(** How many different ways are there to show that [8] is beautiful? *)

(* FILL IN HERE *)
(** [] *)

(** In Coq, we can express the definition of [beautiful] as
    follows: *)

Inductive beautiful : nat -> Prop :=
  b_0   : beautiful 0
| b_3   : beautiful 3
| b_5   : beautiful 5
| b_sum : forall n m, beautiful n -> beautiful m -> beautiful (n+m).

(** The first line declares that [beautiful] is a proposition -- or,
    more formally, a family of propositions "indexed by" natural
    numbers.  (For each number [n], the claim that "[n] is
    [beautiful]" is a proposition.)  Such a family of propositions is
    often called a _property_ of numbers.

    Each of the remaining lines embodies one of the rules for
    beautiful numbers.

    We can use Coq's tactic scripting facility to assemble proofs that
    particular numbers are beautiful. *)

Theorem three_is_beautiful: beautiful 3.
Proof.
   (* This simply follows from the axiom [b_3]. *)
   apply b_3.
Qed.

Theorem eight_is_beautiful: beautiful 8.
Proof.
   (* First we use the rule [b_sum], telling Coq how to
      instantiate [n] and [m]. *)
   apply b_sum with (n:=3) (m:=5).
   (* To solve the subgoals generated by [b_sum], we must provide
      evidence of [beautiful 3] and [beautiful 5]. Fortunately we
      have axioms for both. *)
   apply b_3.
   apply b_5.
Qed.

(* ##################################################### *)
(** * Proof Objects *)

(** Look again at the formal definition of the [beautiful] property.
    The opening keyword, [Inductive], has been used up to this point
    to declare new types of _data_, such as numbers and lists.  Does
    this interpretation also make sense for the Inductive definition
    of [beautiful]?  That is, can we view evidence of beauty as some
    kind of data structure? Yes, we can!

    The trick is to introduce an alternative pronunciation of "[:]".
    Instead of "has type," we can also say "is a proof of."  For
    example, the second line in the definition of [beautiful] declares
    that [b_0 : beautiful 0].  Instead of "[b_0] has type
    [beautiful 0]," we can say that "[b_0] is a proof of [beautiful 0]."
    Similarly for [b_3] and [b_5].

    This pun between "[:]" as "has type" and [:] as "is a proof of" is
    called the _Curry-Howard correspondence_ (or sometimes
    _Curry-Howard isomorphism_).  It proposes a deep connection
    between the world of logic and the world of computation.
<<
                 propositions  ~  types
                 evidence      ~  data
>>
    Many useful things follow from this connection.  To begin with, it
    gives us a natural interpretation of the [b_sum] constructor: *)
(**
    b_sum : forall n m,
            beautiful n -> beautiful m -> beautiful (n+m).
*)
(** If we read [:] as "has type," this says that [b_sum] is a data
    constructor that takes four arguments: two numbers, [n] and [m],
    and two values of type [beautiful n] and [beautiful m].  That is,
    [b_sum] can be viewed as a _function_ that, given evidence for the
    propositions [beautiful n] and [beautiful m], gives us evidence
    for the proposition that [beautiful (n+m)]. *)

(** In view of this, we might wonder whether we can write an
    expression of type [beautiful 8] by applying [b_sum] to
    appropriate arguments.  Indeed, we can: *)

Check (b_sum 3 5 b_3 b_5).

(** The expression [b_sum 3 5 b_3 b_5] can be thought of as
    instantiating the parameterized constructor [b_sum] with the
    specific arguments [3] [5] and the corresponding proof objects for
    its premises [beautiful 3] and [beautiful 5] (Coq is smart enough
    to figure out that 3+5=8).  Alternatively, we can think of [b_sum]
    as a primitive "evidence constructor" that, when applied to two
    particular numbers, wants to be further applied to evidence that
    those two numbers are beautiful; its type,
[[
    forall n m, beautiful n -> beautiful m -> beautiful (n+m),
    expresses this functionality, in the same way that the polymorphic
    type [forall X, list X] in the previous chapter expressed the fact
    that the constructor [nil] can be thought of as a function from
    types to empty lists with elements of that type. *)

(** This gives us an alternative way to write the proof that [8] is
    beautiful: *)

Theorem eight_is_beautiful': beautiful 8.
Proof.
   apply (b_sum 3 5 b_3 b_5).
Qed.

(** Notice that we're using [apply] here in a new way: instead of just
    supplying the _name_ of a hypothesis or previously proved theorem
    whose type matches the current goal, we are supplying an
    _expression_ that directly builds evidence with the required
    type. *)

(* ##################################################### *)
(** ** Proof Scripts and Proof Objects *)

(** These proof objects lie at the core of how Coq operates.

    When Coq is following a proof script, what is happening internally
    is that it is gradually constructing a proof object -- a term
    whose type is the proposition being proved.  The tactics between
    the [Proof] command and the [Qed] instruct Coq how to build up a
    term of the required type.  To see this process in action, let's
    use the [Show Proof] command to display the current state of the
    proof tree at various points in the following tactic proof. *)

Theorem eight_is_beautiful'': beautiful 8.
Proof.
   apply b_sum with (n:=3) (m:=5).
   Show Proof.
   apply b_3.
   Show Proof.
   apply b_5.
   Show Proof.
Qed.

(** At any given moment, Coq has constructed a term with some
    "holes" (indicated by [?1], [?2], and so on), and it knows what
    type of evidence is needed at each hole.  In the [Show Proof]
    output, lines of the form [?1 -> beautiful n] record these
    requirements.  (The [->] here has nothing to do with either
    implication or function types -- it is just an unfortunate choice
    of concrete syntax for the output!)

    Each of the holes corresponds to a subgoal, and the proof is
    finished when there are no more subgoals.  At this point, the
    [Theorem] command gives a name to the evidence we've built and
    stores it in the global context. *)

(** Tactic proofs are useful and convenient because they avoid
    building proof trees by hand, but they are not essential: in
    principle, we can always construct the required evidence by hand.
    Indeed, we don't even need the [Theorem] command: we can use
    [Definition] instead, to directly give a global name to a piece of
    evidence. *)

Definition eight_is_beautiful''' : beautiful 8 :=
  b_sum 3 5 b_3 b_5.

(** All these different ways of building the proof lead to exactly the
    same evidence being saved in the global environment. *)

Print eight_is_beautiful.
(* ===> eight_is_beautiful = b_sum 3 5 b_3 b_5 : beautiful 8 *)
Print eight_is_beautiful'.
(* ===> eight_is_beautiful' = b_sum 3 5 b_3 b_5 : beautiful 8 *)
Print eight_is_beautiful''.
(* ===> eight_is_beautiful'' = b_sum 3 5 b_3 b_5 : beautiful 8 *)
Print eight_is_beautiful'''.
(* ===> eight_is_beautiful''' = b_sum 3 5 b_3 b_5 : beautiful 8 *)

(** **** Exercise: 1 star (six_is_beautiful) *)
(** Give a tactic proof and a proof object showing that [6] is [beautiful]. *)

Theorem six_is_beautiful :
  beautiful 6.
Proof.
  (* FILL IN HERE *) Admitted.

Definition six_is_beautiful' : beautiful 6 :=
  (* FILL IN HERE *) admit.
(** [] *)

(** **** Exercise: 1 star (nine_is_beautiful) *)
(** Give a tactic proof and a proof object showing that [9] is [beautiful]. *)

Theorem nine_is_beautiful :
  beautiful 9.
Proof.
  (* FILL IN HERE *) Admitted.

Definition nine_is_beautiful' : beautiful 9 :=
  (* FILL IN HERE *) admit.
(** [] *)

(* ##################################################### *)
(** ** Implications and Functions *)

(** If we want to substantiate the claim that [P -> Q], what sort of
    proof object should count as evidence?

    We've seen one case above: the [b_sum] constructor, which is
    _primitive_ evidence for an implication proposition -- it is part
    of the very meaning of the word "beautiful" in this context.  But
    what about other implications that we might want to prove?

    For example, consider this statement: *)

Theorem b_plus3: forall n, beautiful n -> beautiful (3+n).
Proof.
   intros n H.
   apply b_sum.
   apply b_3.
   apply H.
Qed.

(** What is the proof object corresponding to [b_plus3]?

    We've made a notational pun between [->] as implication and [->]
    as the type of functions.  If we take this pun seriously, then
    what we're looking for is an expression whose _type_ is
    [forall n, beautiful n -> beautiful (3+n)] -- that is, a
    _function_ that takes two arguments (one number and a piece of
    evidence) and returns a piece of evidence!  Here it is: *)

Definition b_plus3' : forall n, beautiful n -> beautiful (3+n) :=
  fun n => fun H : beautiful n =>
    b_sum 3 n b_3 H.
Check b_plus3'.
(* ===> b_plus3' : forall n, beautiful n -> beautiful (3+n) *)

(** Recall that [fun n => blah] means "the function that, given [n],
    yields [blah]."  Another equivalent way to write this definition is: *)

Definition b_plus3'' (n : nat) (H : beautiful n) : beautiful (3+n) :=
  b_sum 3 n b_3 H.
Check b_plus3''.
(* ===> b_plus3'' : forall n, beautiful n -> beautiful (3+n) *)

(** **** Exercise: 2 stars (b_times2) *)
Theorem b_times2: forall n, beautiful n -> beautiful (2*n).
Proof.
    (* FILL IN HERE *) Admitted.
(** [] *)

(** **** Exercise: 3 stars, optional (b_times2') *)
(** Write a proof object corresponding to [b_times2] above *)

Definition b_times2': forall n, beautiful n -> beautiful (2*n) :=
  (* FILL IN HERE *) admit.

(** **** Exercise: 2 stars (b_timesm) *)
Theorem b_timesm: forall n m, beautiful n -> beautiful (m*n).
Proof.
   (* FILL IN HERE *) Admitted.
(** [] *)

(* ####################################################### *)
(** ** Induction Over Proof Objects *)

(** Since we use the keyword [Induction] to define primitive
    propositions together with their evidence, we might wonder whether
    there are some sort of induction principles associated with these
    definitions.  Indeed there are, and in this section we'll take a
    look at how they can be used.  *)

(** Besides _constructing_ evidence that numbers are beautiful, we can
    also _reason about_ such evidence.  The fact that we introduced
    [beautiful] with an [Inductive] declaration tells us not only that
    the constructors [b_0], [b_3], [b_5] and [b_sum] are ways to build
    evidence, but also that these two constructors are the _only_ ways
    to build evidence that numbers are beautiful. *)

(** In other words, if someone gives us evidence [E] justifying the
    assertion [beautiful n], then we know that [E] can only have one
    of four forms: either [E] is [b_0] (and [n] is [O]) or [E] is
    [b_3] (and [n] is [3]), or [E] is [b_5] (and [n] is [5]), or [E]
    is [b_sum n1 n2 E1 E2] (and [n] is [(n1+n2)], and [E1] is evidence
    that [n1] is beauiful and [E2] is evidence that [n2] is
    beautiful). *)

(** Thus, it makes sense to use the tactics that we have already seen
    for inductively defined _data_ to reason instead about inductively
    defined _evidence_.

    Let's introduce a new property of numbers to help illustrate the
    role of induction. *)

Inductive gorgeous : nat -> Prop :=
  g_0 : gorgeous 0
| g_plus3 : forall n, gorgeous n -> gorgeous (3+n)
| g_plus5 : forall n, gorgeous n -> gorgeous (5+n).

(** **** Exercise: 1 star (gorgeous_tree) *)
(** Write out the definition of gorgeous numbers using the _inference
    rule_ notation.

(* FILL IN HERE *)
[]
*)

(** It seems intuitively obvious that, although [gorgeous] and
    [beautiful] are presented using slightly different rules, they are
    actually the same property in the sense that they are true of the
    same numbers.  Indeed, we can prove this. *)

Theorem gorgeous__beautiful : forall n,
  gorgeous n -> beautiful n.
Proof.
   intros.
   (* The argument proceeds by induction on the evidence H! *)
   induction H as [|n'|n'].
   Case "g_0".
       apply b_0.
   Case "g_plus3".
       apply b_sum. apply b_3.
       apply IHgorgeous.
   Case "g_plus5".
       apply b_sum. apply b_5. apply IHgorgeous.
Qed.

(** Let's see what happens if we try to prove this by induction on [n]
   instead of induction on the evidence [H]. *)

Theorem gorgeous__beautiful_FAILED : forall n,
  gorgeous n -> beautiful n.
Proof.
   intros. induction n as [| n'].
   Case "n = 0". apply b_0.
   Case "n = S n'". (* We are stuck! *)
Admitted.

(** **** Exercise: 1 star (gorgeous_plus13) *)
Theorem gorgeous_plus13: forall n,
  gorgeous n -> gorgeous (13+n).
Proof.
   (* FILL IN HERE *) Admitted.
(** [] *)

(** **** Exercise: 2 stars (gorgeous_plus13_po):
Give the proof object for theorem [gorgeous_plus13] above. *)

Definition gorgeous_plus13_po: forall n, gorgeous n -> gorgeous (13+n):=
   (* FILL IN HERE *) admit.
(** [] *)

(** **** Exercise: 2 stars (gorgeous_sum) *)
Theorem gorgeous_sum : forall n m,
  gorgeous n -> gorgeous m -> gorgeous (n + m).
Proof.
 (* FILL IN HERE *) Admitted.
(** [] *)

(** **** Exercise: 3 stars (beautiful__gorgeous) *)
Theorem beautiful__gorgeous : forall n, beautiful n -> gorgeous n.
Proof.
 (* FILL IN HERE *) Admitted.
(** [] *)

(** **** Exercise: 3 stars, optional (b_times2) *)
(** Prove the [g_times2] theorem below without using [gorgeous__beautiful].
    You might find the following helper lemma useful. *)

Lemma helper_g_times2 : forall x y z, x + (z + y)= z + x + y.
Proof.
   (* FILL IN HERE *) Admitted.

Theorem g_times2: forall n, gorgeous n -> gorgeous (2*n).
Proof.
   intros n H. simpl.
   induction H.
   (* FILL IN HERE *) Admitted.
(** [] *)

(* ####################################################### *)
(** ** Evenness *)

(** In chapter [Basics] we defined a _function_ [evenb] that tests a number
    for evenness, yielding [true] if so.  This gives us an obvious way
    of defining the _concept_ of evenness: *)

Definition even (n:nat) : Prop :=
  evenb n = true.

(** That is, we can define "[n] is even" to mean "the function
    [evenb] returns [true] when applied to [n]."

    Another alternative is to define the concept of evenness directly.
    Instead of going via the [evenb] function ("a number is even if a
    certain computation yields [true]"), we can say what the concept
    of evenness means by giving two different ways of presenting
    _evidence_ that a number is even. *)

Inductive ev : nat -> Prop :=
  | ev_0 : ev O
  | ev_SS : forall n:nat, ev n -> ev (S (S n)).

(** This definition says that there are two ways to give
    evidence that a number [m] is even.  First, [0] is even, and
    [ev_0] is evidence for this.  Second, if [m = S (S n)] for some
    [n] and we can give evidence [e] that [n] is even, then [m] is
    also even, and [ev_SS n e] is the evidence. *)

(** **** Exercise: 1 star (double_even) *)
(** Construct a tactic proof of the following proposition. *)

Theorem double_even : forall n,
  ev (double n).
Proof.
  (* FILL IN HERE *) Admitted.
(** [] *)

(** **** Exercise: 4 stars, optional (double_even_pfobj) *)
(** Try to predict what proof object is constructed by the above
    tactic proof.  (Before checking your answer, you'll want to
    strip out any uses of [Case], as these will make the proof
    object look a bit cluttered.) *)
(** [] *)

(** *** Discussion: Computational vs. Inductive Definitions *)

(** We have seen that the proposition "some number is even" can
    be phrased in two different ways -- indirectly, via a boolean
    testing function [evenb], or directly, by inductively describing
    what constitutes evidence for evenness.  These two ways of
    defining evenness are about equally easy to state and work with.
    Which we choose is basically a question of taste.

    However, for many other properties of interest, the direct
    inductive definition is preferable, since writing a testing
    function may be awkward or even impossible.

    One such property is [beautiful].  This is a perfectly sensible
    definition of a set of numbers, but we cannot translate its
    definition directly as a Coq Fixpoint (or translate it directly
    into a recursive function in any other programming language).  We
    might be able to find a clever way of testing this property using
    a [Fixpoint] (indeed, it is not too hard to find one in this
    case), but in general this could require arbitrarily deep
    thinking.  In fact, if the property we are interested in is
    uncomputable, then we cannot define it as a [Fixpoint] no matter
    how hard we try, because Coq requires that all [Fixpoint]s
    correspond to terminating computations.

    On the other hand, writing an inductive definition of what it
    means to give evidence for the property [beautiful] is
    straightforward. *)

(* ####################################################### *)
(** ** Inverting Evidence *)

(** Besides induction, we can use the other tactics in our toolkit
    with evidence.  For example, this proof uses [destruct] on
    evidence. *)

Theorem ev_minus2: forall n,
  ev n -> ev (pred (pred n)).
Proof.
  intros n E.
  destruct E as [| n' E'].
  Case "E = ev_0". simpl. apply ev_0.
  Case "E = ev_SS n' E'". simpl. apply E'.  Qed.

(** **** Exercise: 1 star, optional (ev_minus2_n) *)
(** What happens if we try to [destruct] on [n] instead of [E]? *)
(** [] *)

(** **** Exercise: 1 star, recommended (ev__even) *)
(** Here is a proof that the inductive definition of evenness implies
    the computational one. *)

Theorem ev__even : forall n,
  ev n -> even n.
Proof.
  intros n E. induction E as [| n' E'].
  Case "E = ev_0".
    unfold even. reflexivity.
  Case "E = ev_SS n' E'".
    unfold even. apply IHE'.
Qed.
(** Could this proof also be carried out by induction on [n] instead
    of [E]?  If not, why not? *)

(* FILL IN HERE *)
(** [] *)

(** The induction principle for inductively defined propositions does
    not follow quite the same form as that of inductively defined
    sets.  For now, you can take the intuitive view that induction on
    evidence [ev n] is similar to induction on [n], but restricts our
    attention to only those numbers for which evidence [ev n] could be
    generated.  We'll look at the induction principle of [ev] in more
    depth below, to explain what's really going on. *)

(** **** Exercise: 1 star (l_fails) *)
(** The following proof attempt will not succeed.
     Theorem l : forall n,
       ev n.
     Proof.
       intros n. induction n.
         Case "O". simpl. apply ev_0.
         Case "S".
           ...
   Briefly explain why.

(* FILL IN HERE *)
*)
(** [] *)

(** **** Exercise: 2 stars (ev_sum) *)
(** Here's another exercise requiring induction. *)

Theorem ev_sum : forall n m,
   ev n -> ev m -> ev (n+m).
Proof.
  (* FILL IN HERE *) Admitted.
(** [] *)

(** Here's another situation where we want to analyze evidence for
    evenness: proving that if [n+2] is even, then [n] is.  Our first
    idea might be to use [destruct] for this kind of case analysis: *)

Theorem SSev_ev_firsttry : forall n,
  ev (S (S n)) -> ev n.
Proof.
  intros n E.
  destruct E as [| n' E'].
  (* Stuck: [destruct] gives us un-provable subgoal here! *)
Admitted.

(** In the first sub-goal, we've lost the information that [n] is [0].
   We could have used [remember], but then we still need [inversion]
   on both cases. *)

Theorem SSev_ev_secondtry : forall n,
  ev (S (S n)) -> ev n.
Proof.
  intros n E. remember (S (S n)) as n2.
  destruct E as [| n' E'].
  Case "n = 0". inversion Heqn2.
  Case "n = S n'". inversion Heqn2. rewrite <- H0. apply E'.
Qed.

(** There is a much simpler way to this: we can use [inversion] directly
    on the inductively defined proposition [ev (S (S n))]. *)

Theorem SSev__even : forall n,
  ev (S (S n)) -> ev n.
Proof.
  intros n E. inversion E as [| n' E']. apply E'. Qed.

(* Print SSev__even. *)

(** This use of [inversion] may seem a bit mysterious at first.
    Until now, we've only used [inversion] on equality
    propositions, to utilize injectivity of constructors or to
    discriminate between different constructors.  But we see here
    that [inversion] can also be applied to analyzing evidence
    for inductively defined propositions.

    Here's how [inversion] works in general.  Suppose the name
    [I] refers to an assumption [P] in the current context, where
    [P] has been defined by an [Inductive] declaration.  Then,
    for each of the constructors of [P], [inversion I] generates
    a subgoal in which [I] has been replaced by the exact,
    specific conditions under which this constructor could have
    been used to prove [P].  Some of these subgoals will be
    self-contradictory; [inversion] throws these away.  The ones
    that are left represent the cases that must be proved to
    establish the original goal.

    In this particular case, the [inversion] analyzed the construction
    [ev (S (S n))], determined that this could only have been
    constructed using [ev_SS], and generated a new subgoal with the
    arguments of that constructor as new hypotheses.  (It also
    produced an auxiliary equality, which happens to be useless here.)
    We'll begin exploring this more general behavior of inversion in
    what follows. *)

(** **** Exercise: 1 star (inversion_practice) *)
Theorem SSSSev__even : forall n,
  ev (S (S (S (S n)))) -> ev n.
Proof.
  (* FILL IN HERE *) Admitted.

(** The [inversion] tactic can also be used to derive goals by showing
    the absurdity of a hypothesis. *)

Theorem even5_nonsense :
  ev 5 -> 2 + 2 = 9.
Proof.
  (* FILL IN HERE *) Admitted.
(** [] *)

(** We can generally use [inversion] on inductive propositions.
    This illustrates that in general, we get one case for each
    possible constructor.  Again, we also get some auxiliary
    equalities that are rewritten in the goal but not in the other
    hypotheses. *)

Theorem ev_minus2': forall n,
  ev n -> ev (pred (pred n)).
Proof.
  intros n E. inversion E as [| n' E'].
  Case "E = ev_0". simpl. apply ev_0.
  Case "E = ev_SS n' E'". simpl. apply E'.  Qed.

(** **** Exercise: 3 stars, recommended (ev_ev__ev) *)
(** Finding the appropriate thing to do induction on is a
    bit tricky here: *)

Theorem ev_ev__ev : forall n m,
  ev (n+m) -> ev n -> ev m.
Proof.
  (* FILL IN HERE *) Admitted.
(** [] *)

(** **** Exercise: 3 stars, optional (ev_plus_plus) *)
(** Here's an exercise that just requires applying existing lemmas.  No
    induction or even case analysis is needed, but some of the rewriting
    may be tedious.  You'll want the [replace] tactic used for [plus_swap']
    in Basics.v *)

Theorem ev_plus_plus : forall n m p,
  ev (n+m) -> ev (n+p) -> ev (m+p).
Proof.
  (* FILL IN HERE *) Admitted.
(** [] *)

(* ##################################################### *)
(* ##################################################### *)
(** * Programming with Propositions *)

(** A _proposition_ is a statement expressing a factual claim,
    like "two plus two equals four."  In Coq, propositions are written
    as expressions of type [Prop].  Although we haven't mentioned it
    explicitly, we have already seen numerous examples. *)

Check (2 + 2 = 4).
(* ===> 2 + 2 = 4 : Prop *)

Check (ble_nat 3 2 = false).
(* ===> ble_nat 3 2 = false : Prop *)

Check (beautiful 8).
(* ===> beautiful 8 : Prop *)

(** Both provable and unprovable claims are perfectly good
    propositions.  Simply _being_ a proposition is one thing; being
    _provable_ is something else! *)

Check (2 + 2 = 5).
(* ===> 2 + 2 = 5 : Prop *)

Check (beautiful 4).
(* ===> beautiful 4 : Prop *)

(** Both [2 + 2 = 4] and [2 + 2 = 5] are legal expressions
    of type [Prop]. *)

(** We've seen one way that propositions can be used in Coq: in
    [Theorem] (and [Lemma] and [Example]) declarations. *)

Theorem plus_2_2_is_4 :
  2 + 2 = 4.
Proof. reflexivity.  Qed.

(** But they can be used in many other ways.  For example, we
    can give a name to a proposition using a [Definition], just as we
    have given names to expressions of other sorts (numbers,
    functions, types, type functions, ...). *)

Definition plus_fact : Prop  :=  2 + 2 = 4.
Check plus_fact.
(* ===> plus_fact : Prop *)

(** Now we can use this name in any situation where a proposition is
    expected -- for example, as the claim in a [Theorem]
    declaration. *)

Theorem plus_fact_is_true :
  plus_fact.
Proof. reflexivity.  Qed.

(** There are many ways of constructing propositions.  We can define a
    new proposition primitively using [Inductive], we can form an
    equality proposition from two computational expressions, and we
    can build up a new proposition from existing ones using
    implication and quantification. *)

Definition strange_prop1 : Prop :=
  (2 + 2 = 5) -> (99 + 26 = 42).

(** Also, given a proposition [P] with a free variable [n], we can
    form the proposition [forall n, P]. *)

Definition strange_prop2 :=
  forall n, (ble_nat n 17 = true) -> (ble_nat n 99 = true).

(** We can also define _parameterized propositions_, such as
    the property of being even. *)

Check even.
(* ===> even : nat -> Prop *)
Check (even 4).
(* ===> even 4 : Prop *)
Check (even 3).
(* ===> even 3 : Prop *)

(** The type of [even], [nat->Prop], can be pronounced in three
    equivalent ways: (1) "[even] is a _function_ from numbers to
    propositions," (2) "[even] is a _family_ of propositions, indexed
    by a number [n]," or (3) "[even] is a _property_ of numbers."  *)

(** Propositions -- including parameterized propositions -- are
    first-class citizens in Coq.  For example, we can define them to
    take multiple arguments... *)

Definition between (n m o: nat) : Prop :=
  andb (ble_nat n o) (ble_nat o m) = true.

(** ... and then partially apply them: *)

Definition teen : nat->Prop := between 13 19.

(** We can even pass propositions -- including parameterized
    propositions -- as arguments to functions: *)

Definition true_for_zero (P:nat->Prop) : Prop :=
  P 0.

(** Here are two more examples of passing parameterized propositions
    as arguments to a function.  The first takes a proposition [P] as
    argument and builds the proposition that [P] is true for all
    natural numbers.  The second takes [P] and builds the proposition
    that, if [P] is true for some natural number [n'], then it is also
    true by the successor of [n'] -- i.e. that [P] is _preserved by
    successor_:*)

Definition true_for_all_numbers (P:nat->Prop) : Prop :=
  forall n, P n.

Definition preserved_by_S (P:nat->Prop) : Prop :=
  forall n', P n' -> P (S n').

(* ##################################################### *)
(** * Induction Principles *)

(** This is a good point to pause and take a deeper look at induction
    principles in general. *)

(* ##################################################### *)
(** ** Induction Principles for Inductively Defined Types *)

(** Every time we declare a new [Inductive] datatype, Coq
    automatically generates an axiom that embodies an _induction
    principle_ for this type.

    The induction principle for a type [t] is called [t_ind].  Here is
    the one for natural numbers: *)

Check nat_ind.
(*  ===> nat_ind :
           forall P : nat -> Prop,
              P 0  ->
              (forall n : nat, P n -> P (S n))  ->
              forall n : nat, P n  *)

(** The [induction] tactic is a straightforward wrapper that, at
    its core, simply performs [apply t_ind].  To see this more
    clearly, let's experiment a little with using [apply nat_ind]
    directly, instead of the [induction] tactic, to carry out some
    proofs.  Here, for example, is an alternate proof of a theorem
    that we saw in the [Basics] chapter. *)

Theorem mult_0_r' : forall n:nat,
  n * 0 = 0.
Proof.
  apply nat_ind.
  Case "O". reflexivity.
  Case "S". simpl. intros n IHn. rewrite -> IHn.
    reflexivity.  Qed.

(** This proof is basically the same as the earlier one, but a
    few minor differences are worth noting.  First, in the induction
    step of the proof (the ["S"] case), we have to do a little
    bookkeeping manually (the [intros]) that [induction] does
    automatically.

    Second, we do not introduce [n] into the context before applying
    [nat_ind] -- the conclusion of [nat_ind] is a quantified formula,
    and [apply] needs this conclusion to exactly match the shape of
    the goal state, including the quantifier.  The [induction] tactic
    works either with a variable in the context or a quantified
    variable in the goal.

    Third, the [apply] tactic automatically chooses variable names for
    us (in the second subgoal, here), whereas [induction] lets us
    specify (with the [as...]  clause) what names should be used.  The
    automatic choice is actually a little unfortunate, since it
    re-uses the name [n] for a variable that is different from the [n]
    in the original theorem.  This is why the [Case] annotation is
    just [S] -- if we tried to write it out in the more explicit form
    that we've been using for most proofs, we'd have to write [n = S
    n], which doesn't make a lot of sense!  All of these conveniences
    make [induction] nicer to use in practice than applying induction
    principles like [nat_ind] directly.  But it is important to
    realize that, modulo this little bit of bookkeeping, applying
    [nat_ind] is what we are really doing. *)

(** **** Exercise: 2 stars, optional (plus_one_r') *)
(** Complete this proof as we did [mult_0_r'] above, without using
    the [induction] tactic. *)

Theorem plus_one_r' : forall n:nat,
  n + 1 = S n.
Proof.
  (* FILL IN HERE *) Admitted.
(** [] *)

(** The induction principles that Coq generates for other datatypes
    defined with [Inductive] follow a similar pattern. If we define a
    type [t] with constructors [c1] ... [cn], Coq generates a theorem
    with this shape:
    t_ind :
       forall P : t -> Prop,
            ... case for c1 ... ->
            ... case for c2 ... ->
            ...                 ->
            ... case for cn ... ->
            forall n : t, P n
    The specific shape of each case depends on the arguments to the
    corresponding constructor.  Before trying to write down a general
    rule, let's look at some more examples. First, an example where
    the constructors take no arguments: *)

Inductive yesno : Type :=
  | yes : yesno
  | no : yesno.

Check yesno_ind.
(* ===> yesno_ind : forall P : yesno -> Prop,
                      P yes  ->
                      P no  ->
                      forall y : yesno, P y *)

(** **** Exercise: 1 star (rgb) *)
(** Write out the induction principle that Coq will generate for
    the following datatype.  Write down your answer on paper, and
    then compare it with what Coq prints. *)

Inductive rgb : Type :=
  | red : rgb
  | green : rgb
  | blue : rgb.
Check rgb_ind.
(** [] *)

(** Here's another example, this time with one of the constructors
    taking some arguments. *)

Inductive natlist : Type :=
  | nnil : natlist
  | ncons : nat -> natlist -> natlist.

Check natlist_ind.
(* ===> (modulo a little tidying)
   natlist_ind :
      forall P : natlist -> Prop,
         P nnil  ->
         (forall (n : nat) (l : natlist), P l -> P (ncons n l)) ->
         forall n : natlist, P n *)

(** **** Exercise: 1 star (natlist1) *)
(** Suppose we had written the above definition a little
   differently: *)

Inductive natlist1 : Type :=
  | nnil1 : natlist1
  | nsnoc1 : natlist1 -> nat -> natlist1.

(** Now what will the induction principle look like? *)
(** [] *)

(** From these examples, we can extract this general rule:

    - The type declaration gives several constructors; each
      corresponds to one clause of the induction principle.
    - Each constructor [c] takes argument types [a1]...[an].
    - Each [ai] can be either [t] (the datatype we are defining) or
      some other type [s].
    - The corresponding case of the induction principle
      says (in English):
        - "for all values [x1]...[xn] of types [a1]...[an], if
           [P] holds for each of the [x]s of type [t], then [P]
           holds for [c x1 ... xn]". *)

(** **** Exercise: 1 star (ex_set) *)
(** Here is an induction principle for an inductively defined
    set.
      ExSet_ind :
         forall P : ExSet -> Prop,
             (forall b : bool, P (con1 b)) ->
             (forall (n : nat) (e : ExSet), P e -> P (con2 n e)) ->
             forall e : ExSet, P e
    Give an [Inductive] definition of [ExSet]: *)

Inductive ExSet : Type :=
  (* FILL IN HERE *)
.
(** [] *)

(** What about polymorphic datatypes?

    The inductive definition of polymorphic lists
      Inductive list (X:Type) : Type :=
        | nil : list X
        | cons : X -> list X -> list X.
    is very similar to that of [natlist].  The main difference is
    that, here, the whole definition is _parameterized_ on a set [X]:
    that is, we are defining a _family_ of inductive types [list X],
    one for each [X].  (Note that, wherever [list] appears in the body
    of the declaration, it is always applied to the parameter [X].)
    The induction principle is likewise parameterized on [X]:
     list_ind :
       forall (X : Type) (P : list X -> Prop),
          P [] ->
          (forall (x : X) (l : list X), P l -> P (x :: l)) ->
          forall l : list X, P l
   Note the wording here (and, accordingly, the form of [list_ind]):
   The _whole_ induction principle is parameterized on [X].  That is,
   [list_ind] can be thought of as a polymorphic function that, when
   applied to a type [X], gives us back an induction principle
   specialized to the type [list X]. *)

(** **** Exercise: 1 star (tree) *)
(** Write out the induction principle that Coq will generate for
   the following datatype.  Compare your answer with what Coq
   prints. *)

Inductive tree (X:Type) : Type :=
  | leaf : X -> tree X
  | node : tree X -> tree X -> tree X.
Check tree_ind.
(** [] *)

(** **** Exercise: 1 star (mytype) *)
(** Find an inductive definition that gives rise to the
    following induction principle:
      mytype_ind :
        forall (X : Type) (P : mytype X -> Prop),
            (forall x : X, P (constr1 X x)) ->
            (forall n : nat, P (constr2 X n)) ->
            (forall m : mytype X, P m ->
               forall n : nat, P (constr3 X m n)) ->
            forall m : mytype X, P m
*)
(** [] *)

(** **** Exercise: 1 star, optional (foo) *)
(** Find an inductive definition that gives rise to the
    following induction principle:
      foo_ind :
        forall (X Y : Type) (P : foo X Y -> Prop),
             (forall x : X, P (bar X Y x)) ->
             (forall y : Y, P (baz X Y y)) ->
             (forall f1 : nat -> foo X Y,
               (forall n : nat, P (f1 n)) -> P (quux X Y f1)) ->
             forall f2 : foo X Y, P f2
*)
(** [] *)

(** **** Exercise: 1 star, optional (foo') *)
(** Consider the following inductive definition: *)

Inductive foo' (X:Type) : Type :=
  | C1 : list X -> foo' X -> foo' X
  | C2 : foo' X.

(** What induction principle will Coq generate for [foo']?  Fill
   in the blanks, then check your answer with Coq.)
     foo'_ind :
        forall (X : Type) (P : foo' X -> Prop),
              (forall (l : list X) (f : foo' X),
                    _______________________ ->
                    _______________________   ) ->
             ___________________________________________ ->
             forall f : foo' X, ________________________
*)

(** [] *)

(* ##################################################### *)
(** ** Induction Hypotheses *)

(** Where does the phrase "induction hypothesis" fit into this story?

    The induction principle for numbers
       forall P : nat -> Prop,
            P 0  ->
            (forall n : nat, P n -> P (S n))  ->
            forall n : nat, P n
   is a generic statement that holds for all propositions
   [P] (strictly speaking, for all families of propositions [P]
   indexed by a number [n]).  Each time we use this principle, we
   are choosing [P] to be a particular expression of type
   [nat->Prop].

   We can make the proof more explicit by giving this expression a
   name.  For example, instead of stating the theorem [mult_0_r] as
   "[forall n, n * 0 = 0]," we can write it as "[forall n, P_m0r
   n]", where [P_m0r] is defined as... *)

Definition P_m0r (n:nat) : Prop :=
  n * 0 = 0.

(** ... or equivalently... *)

Definition P_m0r' : nat->Prop :=
  fun n => n * 0 = 0.

(** Now when we do the proof it is easier to see where [P_m0r]
    appears. *)

Theorem mult_0_r'' : forall n:nat,
  P_m0r n.
Proof.
  apply nat_ind.
  Case "n = O". reflexivity.
  Case "n = S n'".
    (* Note the proof state at this point! *)
    unfold P_m0r. simpl. intros n' IHn'.
    apply IHn'.  Qed.

(** This extra naming step isn't something that we'll do in
    normal proofs, but it is useful to do it explicitly for an example
    or two, because it allows us to see exactly what the induction
    hypothesis is.  If we prove [forall n, P_m0r n] by induction on
    [n] (using either [induction] or [apply nat_ind]), we see that the
    first subgoal requires us to prove [P_m0r 0] ("[P] holds for
    zero"), while the second subgoal requires us to prove [forall n',
    P_m0r n' -> P_m0r n' (S n')] (that is "[P] holds of [S n'] if it
    holds of [n']" or, more elegantly, "[P] is preserved by [S]").
    The _induction hypothesis_ is the premise of this latter
    implication -- the assumption that [P] holds of [n'], which we are
    allowed to use in proving that [P] holds for [S n']. *)

(* ##################################################### *)
(** * Optional Material *)

(** This section offers some additional details on how induction works
    in Coq and the process of building proof trees.  It can safely be
    skimmed on a first reading.  (We recommend skimming rather than
    skipping over it outright: it answers some questions that occur to
    many Coq users at some point, so it is useful to have a rough idea
    of what's here.) *)

(* ##################################################### *)
(** ** Induction Principles in [Prop] *)

(** Earlier, we looked in detail at the induction principles that Coq
    generates for inductively defined _sets_.  The induction
    principles for inductively defined _propositions_ like [gorgeous]
    are a tiny bit more complicated.  As with all induction
    principles, we want to use the induction principle on [gorgeous]
    to prove things by inductively considering the possible shapes
    that something in [gorgeous] can have -- either it is evidence
    that [0] is gorgeous, or it is evidence that, for some [n], [3+n]
    is gorgeous, or it is evidence that, for some [n], [5+n] is
    gorgeous and it includes evidence that [n] itself is.  Intuitively
    speaking, however, what we want to prove are not statements about
    _evidence_ but statements about _numbers_.  So we want an
    induction principle that lets us prove properties of numbers by
    induction on evidence.

    For example, from what we've said so far, you might expect the
    inductive definition of [gorgeous]...
    Inductive gorgeous : nat -> Prop :=
         g_0 : gorgeous 0
       | g_plus3 : forall n, gorgeous n -> gorgeous (3+m)
       | g_plus5 : forall n, gorgeous n -> gorgeous (5+m).
    ...to give rise to an induction principle that looks like this...
    gorgeous_ind_max :
       forall P : (forall n : nat, gorgeous n -> Prop),
            P O g_0 ->
            (forall (m : nat) (e : gorgeous m),
               P m e -> P (3+m) (g_plus3 m e) ->
            (forall (m : nat) (e : gorgeous m),
               P m e -> P (5+m) (g_plus5 m e) ->
            forall (n : nat) (e : gorgeous n), P n e
    ... because:

     - Since [gorgeous] is indexed by a number [n] (every [gorgeous]
       object [e] is a piece of evidence that some particular number
       [n] is gorgeous), the proposition [P] is parameterized by both
       [n] and [e] -- that is, the induction principle can be used to
       prove assertions involving both a gorgeous number and the
       evidence that it is gorgeous.

     - Since there are three ways of giving evidence of gorgeousness
       ([gorgeous] has three constructors), applying the induction
       principle generates three subgoals:

         - We must prove that [P] holds for [O] and [b_0].

         - We must prove that, whenever [n] is a gorgeous
           number and [e] is an evidence of its gorgeousness,
           if [P] holds of [n] and [e],
           then it also holds of [3+m] and [g_plus3 n e].

         - We must prove that, whenever [n] is a gorgeous
           number and [e] is an evidence of its gorgeousness,
           if [P] holds of [n] and [e],
           then it also holds of [5+m] and [g_plus5 n e].

     - If these subgoals can be proved, then the induction principle
       tells us that [P] is true for _all_ gorgeous numbers [n] and
       evidence [e] of their gorgeousness.

    But this is a little more flexibility than we actually need or
    want: it is giving us a way to prove logical assertions where the
    assertion involves properties of some piece of _evidence_ of
    gorgeousness, while all we really care about is proving
    properties of _numbers_ that are gorgeous -- we are interested in
    assertions about numbers, not about evidence.  It would therefore
    be more convenient to have an induction principle for proving
    propositions [P] that are parameterized just by [n] and whose
    conclusion establishes [P] for all gorgeous numbers [n]:
       forall P : nat -> Prop,
          ... ->
             forall n : nat, gorgeous n -> P n
    For this reason, Coq actually generates the following simplified
    induction principle for [gorgeous]: *)

Check gorgeous_ind.
(* ===>  gorgeous_ind
     : forall P : nat -> Prop,
       P 0 ->
       (forall n : nat, gorgeous n -> P n -> P (3 + n)) ->
       (forall n : nat, gorgeous n -> P n -> P (5 + n)) ->
       forall n : nat, gorgeous n -> P n *)

(** In particular, Coq has dropped the evidence term [e] as a
    parameter of the the proposition [P], and consequently has
    rewritten the assumption [forall (n : nat) (e: gorgeous n), ...]
    to be [forall (n : nat), gorgeous n -> ...]; i.e., we no longer
    require explicit evidence of the provability of [gorgeous n]. *)

(** In English, [gorgeous_ind] says:

    - Suppose, [P] is a property of natural numbers (that is, [P n] is
      a [Prop] for every [n]).  To show that [P n] holds whenever [n]
      is gorgeous, it suffices to show:

      - [P] holds for [0],

      - for any [n], if [n] is gorgeous and [P] holds for
        [n], then [P] holds for [3+n],

      - for any [n], if [n] is gorgeous and [P] holds for
        [n], then [P] holds for [5+n]. *)

(** We can apply [gorgeous_ind] directly instead of using [induction]. *)

Theorem gorgeous__beautiful' : forall n, gorgeous n -> beautiful n.
Proof.
   intros.
   apply gorgeous_ind.
   Case "g_0".
       apply b_0.
   Case "g_plus3".
       intros.
       apply b_sum. apply b_3.
       apply H1.
   Case "g_plus5".
       intros.
       apply b_sum. apply b_5.
       apply H1.
   apply H.
Qed.

Module P.

(** **** Exercise: 3 stars, optional (p_provability) *)
(** Consider the following inductively defined proposition: *)

Inductive p : (tree nat) -> nat -> Prop :=
   | c1 : forall n, p (leaf _ n) 1
   | c2 : forall t1 t2 n1 n2,
            p t1 n1 -> p t2 n2 -> p (node _ t1 t2) (n1 + n2)
   | c3 : forall t n, p t n -> p t (S n).

(** Describe, in English, the conditions under which the
   proposition [p t n] is provable.

   (* FILL IN HERE *)
*)
(** [] *)

End P.

(* ##################################################### *)
(** ** More on the [induction] Tactic *)

(** The [induction] tactic actually does even more low-level
    bookkeeping for us than we discussed above.

    Recall the informal statement of the induction principle for
    natural numbers:
      - If [P n] is some proposition involving a natural number n, and
        we want to show that P holds for _all_ numbers n, we can
        reason like this:
          - show that [P O] holds
          - show that, if [P n'] holds, then so does [P (S n')]
          - conclude that [P n] holds for all n.
    So, when we begin a proof with [intros n] and then [induction n],
    we are first telling Coq to consider a _particular_ [n] (by
    introducing it into the context) and then telling it to prove
    something about _all_ numbers (by using induction).

    What Coq actually does in this situation, internally, is to
    "re-generalize" the variable we perform induction on.  For
    example, in the proof above that [plus] is associative...
*)

Theorem plus_assoc' : forall n m p : nat,
  n + (m + p) = (n + m) + p.
Proof.
  (* ...we first introduce all 3 variables into the context,
     which amounts to saying "Consider an arbitrary [n], [m], and
     [p]..." *)
  intros n m p.
  (* ...We now use the [induction] tactic to prove [P n] (that
     is, [n + (m + p) = (n + m) + p]) for _all_ [n],
     and hence also for the particular [n] that is in the context
     at the moment. *)
  induction n as [| n'].
  Case "n = O". reflexivity.
  Case "n = S n'".
    (* In the second subgoal generated by [induction] -- the
       "inductive step" -- we must prove that [P n'] implies
       [P (S n')] for all [n'].  The [induction] tactic
       automatically introduces [n'] and [P n'] into the context
       for us, leaving just [P (S n')] as the goal. *)
    simpl. rewrite -> IHn'. reflexivity.  Qed.

(** It also works to apply [induction] to a variable that is
   quantified in the goal. *)

Theorem plus_comm' : forall n m : nat,
  n + m = m + n.
Proof.
  induction n as [| n'].
  Case "n = O". intros m. rewrite -> plus_0_r. reflexivity.
  Case "n = S n'". intros m. simpl. rewrite -> IHn'.
    rewrite <- plus_n_Sm. reflexivity.  Qed.

(** Note that [induction n] leaves [m] still bound in the goal --
    i.e., what we are proving inductively is a statement beginning
    with [forall m].

    If we do [induction] on a variable that is quantified in the goal
    _after_ some other quantifiers, the [induction] tactic will
    automatically introduce the variables bound by these quantifiers
    into the context. *)

Theorem plus_comm'' : forall n m : nat,
  n + m = m + n.
Proof.
  (* Let's do induction on [m] this time, instead of [n]... *)
  induction m as [| m'].
  Case "m = O". simpl. rewrite -> plus_0_r. reflexivity.
  Case "m = S m'". simpl. rewrite <- IHm'.
    rewrite <- plus_n_Sm. reflexivity.  Qed.

(** **** Exercise: 1 star, optional (plus_explicit_prop) *)
(** Rewrite both [plus_assoc'] and [plus_comm'] and their proofs in
    the same style as [mult_0_r''] above -- that is, for each theorem,
    give an explicit [Definition] of the proposition being proved by
    induction, and state the theorem and proof in terms of this
    defined proposition.  *)

(* FILL IN HERE *)
(** [] *)

(* ##################################################### *)
(** One more quick digression, for adventurous souls: if we can define
    parameterized propositions using [Definition], then can we also
    define them using [Fixpoint]?  Of course we can!  However, this
    kind of "recursive parameterization" doesn't correspond to
    anything very familiar from everyday mathematics.  The following
    exercise gives a slightly contrived example. *)

(** **** Exercise: 4 stars, optional (true_upto_n__true_everywhere) *)
(** Define a recursive function
    [true_upto_n__true_everywhere] that makes
    [true_upto_n_example] work. *)

(*
Fixpoint true_upto_n__true_everywhere
(* FILL IN HERE *)

Example true_upto_n_example :
    (true_upto_n__true_everywhere 3 (fun n => even n))
  = (even 3 -> even 2 -> even 1 -> forall m : nat, even m).
Proof. reflexivity.  Qed.
*)
(** [] *)

(* ####################################################### *)
(** ** Building Proof Objects Incrementally *)

(** As you probably noticed while solving the exercises earlier in the
    chapter, constructing proof objects is more involved than
    constructing the corresponding tactic proofs. Fortunately, there
    is a bit of syntactic sugar that we've already introduced to help
    in the construction: the [admit] term, which we've sometimes used
    to force Coq into accepting incomplete exercies. As an example,
    let's walk through the process of constructing a proof object
    demonstrating the beauty of [16]. *)

Definition b_16_atmpt_1 : beautiful 16 := admit.

(** Maybe we can use [b_sum] to construct a term of type [beautiful 16]?
    Recall that [b_sum] is of type

    forall n m : nat, beautiful n -> beautiful m -> beautiful (n + m)

    If we can demonstrate the beauty of [5] and [11], we should
    be done. *)

Definition b_16_atmpt_2 : beautiful 16 := b_sum 5 11 admit admit.

(** In the attempt above, we've omitted the proofs of the propositions
    that [5] and [11] are beautiful. But the first of these is already
    axiomatized in [b_5]: *)

Definition b_16_atmpt_3 : beautiful 16 := b_sum 5 11 b_5 admit.

(** What remains is to show that [11] is beautiful. We repeat the
    procedure: *)

Definition b_16_atmpt_4 : beautiful 16 :=
  b_sum 5 11 b_5 (b_sum 5 6 admit admit).

Definition b_16_atmpt_5 : beautiful 16 :=
  b_sum 5 11 b_5 (b_sum 5 6 b_5 admit).

Definition b_16_atmpt_6 : beautiful 16 :=
  b_sum 5 11 b_5 (b_sum 5 6 b_5 (b_sum 3 3 admit admit)).

(** And finally, we can complete the proof object: *)

Definition b_16 : beautiful 16 :=
  b_sum 5 11 b_5 (b_sum 5 6 b_5 (b_sum 3 3 b_3 b_3)).

(** To recap, we've been guided by an informal proof that we have in
    our minds, and we check the high level details before completing
    the intricacies of the proof. The [admit] term allows us to do
    this. *)

(* ####################################################### *)
(** * Additional Exercises *)

(** **** Exercise: 4 stars, recommended (palindromes) *)
(** A palindrome is a sequence that reads the same backwards as
    forwards.

    - Define an inductive proposition [pal] on [list X] that
      captures what it means to be a palindrome. (Hint: You'll need
      three cases.  Your definition should be based on the structure
      of the list; just having a single constructor
    c : forall l, l = rev l -> pal l
      may seem obvious, but will not work very well.)

    - Prove that
       forall l, pal (l ++ rev l).
    - Prove that
       forall l, pal l -> l = rev l.
*)

(* FILL IN HERE *)
(** [] *)

(** **** Exercise: 5 stars, optional (palindrome_converse) *)
(** Using your definition of [pal] from the previous exercise, prove
    that
     forall l, l = rev l -> pal l.
*)

(* FILL IN HERE *)
(** [] *)

(** **** Exercise: 4 stars (subsequence) *)
(** A list is a _subsequence_ of another list if all of the elements
    in the first list occur in the same order in the second list,
    possibly with some extra elements in between. For example,
    [1,2,3]
    is a subsequence of each of the lists
    [1,2,3]
    [1,1,1,2,2,3]
    [1,2,7,3]
    [5,6,1,9,9,2,7,3,8]
    but it is _not_ a subsequence of any of the lists
    [1,2]
    [1,3]
    [5,6,2,1,7,3,8]

    - Define an inductive proposition [subseq] on [list nat] that
      captures what it means to be a subsequence. (Hint: You'll need
      three cases.)

    - Prove that subsequence is reflexive, that is, any list is a
      subsequence of itself.

    - Prove that for any lists [l1], [l2], and [l3], if [l1] is a
      subsequence of [l2], then [l1] is also a subsequence of [l2 ++
      l3].

    - (Optional, harder) Prove that subsequence is transitive -- that
      is, if [l1] is a subsequence of [l2] and [l2] is a subsequence
      of [l3], then [l1] is a subsequence of [l3].  Hint: choose your
      induction carefully!
*)

(* FILL IN HERE *)
(** [] *)

(** **** Exercise: 2 stars, optional (foo_ind_principle) *)
(** Suppose we make the following inductive definition:
   Inductive foo (X : Set) (Y : Set) : Set :=
     | foo1 : X -> foo X Y
     | foo2 : Y -> foo X Y
     | foo3 : foo X Y -> foo X Y.
   Fill in the blanks to complete the induction principle that will be
   generated by Coq.
   foo_ind
        : forall (X Y : Set) (P : foo X Y -> Prop),
          (forall x : X, __________________________________) ->
          (forall y : Y, __________________________________) ->
          (________________________________________________) ->
           ________________________________________________

*)
(** [] *)

(** **** Exercise: 2 stars, optional (bar_ind_principle) *)
(** Consider the following induction principle:
   bar_ind
        : forall P : bar -> Prop,
          (forall n : nat, P (bar1 n)) ->
          (forall b : bar, P b -> P (bar2 b)) ->
          (forall (b : bool) (b0 : bar), P b0 -> P (bar3 b b0)) ->
          forall b : bar, P b
   Write out the corresponding inductive set definition.
   Inductive bar : Set :=
     | bar1 : ________________________________________
     | bar2 : ________________________________________
     | bar3 : ________________________________________.

*)
(** [] *)

(** **** Exercise: 2 stars, optional (no_longer_than_ind) *)
(** Given the following inductively defined proposition:
  Inductive no_longer_than (X : Set) : (list X) -> nat -> Prop :=
    | nlt_nil  : forall n, no_longer_than X [] n
    | nlt_cons : forall x l n, no_longer_than X l n ->
                               no_longer_than X (x::l) (S n)
    | nlt_succ : forall l n, no_longer_than X l n ->
                             no_longer_than X l (S n).
  write the induction principle generated by Coq.
  no_longer_than_ind
       : forall (X : Set) (P : list X -> nat -> Prop),
         (forall n : nat, ____________________) ->
         (forall (x : X) (l : list X) (n : nat),
          no_longer_than X l n -> ____________________ ->
                                  _____________________________ ->
         (forall (l : list X) (n : nat),
          no_longer_than X l n -> ____________________ ->
                                  _____________________________ ->
         forall (l : list X) (n : nat), no_longer_than X l n ->
           ____________________

*)
(** [] *)

(** **** Exercise: 2 stars, optional (R_provability) *)
(** Suppose we give Coq the following definition:
    Inductive R : nat -> list nat -> Prop :=
      | c1 : R 0 []
      | c2 : forall n l, R n l -> R (S n) (n :: l)
      | c3 : forall n l, R (S n) l -> R n l.
    Which of the following propositions are provable?

    - [R 2 [1,0]]
    - [R 1 [1,2,1,0]]
    - [R 6 [3,2,1,0]]
*)

(** [] *)

(* ##################################################### *)
(* ##################################################### *)
(* ##################################################### *)
(* ##################################################### *)


(* *****************************************************************)
(*                                                                 *)
(*               Verified polyhedral AST generation                *)
(*                                                                 *)
(*                 Nathanaël Courant, Inria Paris                  *)
(*                                                                 *)
(*  Copyright Inria. All rights reserved. This file is distributed *)
(*  under the terms of the GNU Lesser General Public License as    *)
(*  published by the Free Software Foundation, either version 2.1  *)
(*  of the License, or (at your option) any later version.         *)
(*                                                                 *)
(* *****************************************************************)

Require Import ZArith.
Require Import List.
Require Import Bool.
Require Import Psatz.

Require Import Misc.
Require Import Linalg.

Open Scope Z_scope.

Fixpoint minindex {A : Type} (f : A -> Z) (l : list A) : option A :=
  match l with
  | nil => None
  | x :: l => match minindex f l with None => Some x | Some y => if f x <? f y then Some x else Some y end
  end.

Lemma minindex_In :
  forall A f (l : list A) x, minindex f l = Some x -> In x l.
Proof.
  induction l.
  - intros; simpl in *; congruence.
  - intros x H; simpl in *. destruct (minindex f l) as [u|].
    + specialize (IHl u). destruct (f a <? f u); injection H; intros H1; rewrite <- H1; tauto.
    + injection H; intros; tauto.
Qed.

(** * Finding equalities: useful for reducing constraints on a given variable in a polyhedron *)
Definition find_eq (n : nat) (p : polyhedron) :=
  let l1 := filter (fun c => 0 <? nth n (fst c) 0) p in
  let l2 := filter (fun c => nth n (fst c) 0 <? 0) p in
  let l12 := list_prod l1 l2 in
  let flt := map fst (filter (fun c12 => is_eq (fst (fst c12)) (mult_vector (-1) (fst (snd c12))) && (snd (fst c12) =? -snd (snd c12))) l12) in
  minindex (fun c => nth n (fst c) 0) flt.

Theorem find_eq_in :
  forall n pol c, find_eq n pol = Some c -> In c pol.
Proof.
  intros n pol c Hfind. unfold find_eq in *.
  apply minindex_In in Hfind.
  rewrite in_map_iff in Hfind; destruct Hfind as [[c1 c2] [Heq Hfind1]].
  simpl in Heq; rewrite Heq in *.
  rewrite filter_In in Hfind1. destruct Hfind1 as [Hfind1 Heq1].
  rewrite in_prod_iff, !filter_In in Hfind1. tauto.
Qed.

Theorem find_eq_correct :
  forall n pol c p t, 0 < t -> find_eq n pol = Some c ->
                 (forall c, In c pol -> nth n (fst c) 0 <> 0 -> satisfies_constraint p (mult_constraint_cst t c) = true) -> dot_product p (fst c) = t * snd c.
Proof.
  intros n pol c p t Ht Hfind Hin.
  unfold find_eq, in_poly, satisfies_constraint in *.
  apply minindex_In in Hfind.
  rewrite in_map_iff in Hfind; destruct Hfind as [[c1 c2] [Heq Hfind1]].
  simpl in Heq; rewrite Heq in *.
  rewrite filter_In, in_prod_iff, !filter_In in Hfind1. reflect. destruct Hfind1 as [[[Hin1 ?] [Hin2 ?]] [Heql Heqr]].
  simpl in *; reflect.
  apply Hin in Hin1; apply Hin in Hin2; try lia; reflect.
  rewrite Heql, dot_product_mult_right in *. nia.
Qed.

Theorem find_eq_correct_1 :
  forall n pol c p, find_eq n pol = Some c -> (forall c, In c pol -> nth n (fst c) 0 <> 0 -> satisfies_constraint p c = true) -> dot_product p (fst c) = snd c.
Proof.
  intros n pol c p Hfind Hin.
  rewrite find_eq_correct with (t := 1) (n := n) (pol := pol); auto; try lia.
  intros c1. rewrite mult_constraint_cst_1. apply Hin.
Qed.

Theorem find_eq_nth :
  forall n pol c, find_eq n pol = Some c -> 0 < nth n (fst c) 0.
Proof.
  intros n pol c Hfind.
  unfold find_eq in *.
  apply minindex_In in Hfind.
  rewrite in_map_iff in Hfind; destruct Hfind as [[c1 c2] [Heq Hfind1]].
  simpl in Heq; rewrite Heq in *.
  rewrite filter_In, in_prod_iff, !filter_In in Hfind1. reflect. destruct Hfind1 as [[[? ?] [? ?]] ?].
  auto.
Qed.

Definition make_constraint_with_eq n c1 c2 :=
  let '(g, (aa, bb)) := Z.ggcd (nth n (fst c1) 0) (nth n (fst c2) 0) in
  add_constraint (mult_constraint (Z.sgn aa * -bb) c1) (mult_constraint (Z.abs aa) c2).

Lemma make_constraint_with_eq_correct :
  forall n c1 c2 p t, dot_product p (fst c1) = t * snd c1 -> nth n (fst c1) 0 <> 0 ->
                 satisfies_constraint p (mult_constraint_cst t (make_constraint_with_eq n c1 c2)) = satisfies_constraint p (mult_constraint_cst t c2).
Proof.
  intros n c1 c2 p t Hc1 Hcnz1. unfold make_constraint_with_eq.
  remember (nth n (fst c1) 0) as a.
  remember (nth n (fst c2) 0) as b.
  generalize (Z.ggcd_correct_divisors a b). generalize (Z.ggcd_gcd a b).
  destruct Z.ggcd as [g [aa bb]] eqn:Hggcd. simpl. intros Hg [Haa Hbb].
  unfold satisfies_constraint, add_constraint, mult_constraint; simpl.
  rewrite add_vector_dot_product_distr_right, !dot_product_mult_right, eq_iff_eq_true; reflect.
  nia.
Qed.

Lemma make_constraint_with_eq_correct_1 :
  forall n c1 c2 p, dot_product p (fst c1) = snd c1 -> nth n (fst c1) 0 <> 0 ->
               satisfies_constraint p (make_constraint_with_eq n c1 c2) = satisfies_constraint p c2.
Proof.
  intros n c1 c2 p Hc1 Hcnz1.
  generalize (make_constraint_with_eq_correct n c1 c2 p 1).
  rewrite !mult_constraint_cst_1. intros H; apply H; lia.
Qed.

Lemma make_constraint_with_eq_nth :
  forall n c1 c2, nth n (fst c1) 0 <> 0 -> nth n (fst (make_constraint_with_eq n c1 c2)) 0 = 0.
Proof.
  intros n c1 c2 Hcnz1. unfold make_constraint_with_eq.
  remember (nth n (fst c1) 0) as a.
  remember (nth n (fst c2) 0) as b.
  generalize (Z.ggcd_correct_divisors a b). generalize (Z.ggcd_gcd a b).
  destruct Z.ggcd as [g [aa bb]] eqn:Hggcd. simpl. intros Hg [Haa Hbb].
  unfold satisfies_constraint, add_constraint, mult_constraint; simpl.
  rewrite add_vector_nth, !mult_nth.
  nia.
Qed.

Lemma make_constraint_with_eq_preserve_zeros :
  forall n m c1 c2, nth n (fst c1) 0 = 0 -> nth n (fst c2) 0 = 0 -> nth n (fst (make_constraint_with_eq m c1 c2)) 0 = 0.
Proof.
  intros n m c1 c2 H1 H2. unfold make_constraint_with_eq.
  destruct Z.ggcd as [? [? ?]]. unfold add_constraint, mult_constraint. simpl.
  rewrite add_vector_nth, !mult_nth. nia.
Qed.